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Introduction 


Context 


In the modern internet era, an unprecedented amount of information is being collected about people every day, to the 
extent that children have data footprints from the moment they are born (and sometimes before).* 


Children are also spending more and more time online at younger and younger ages, as illustrated in the finding that over 
half (53%) of 3-4 year olds and almost all (99%) of 12-15 year olds were online in 2017.2 While it is clearly important for 
children to benefit from all that the internet has to offer, these recent figures bring considerations of children’s online safety, 


privacy and data rights into sharp focus. Indeed, it is a clear imperative for the ICO to produce the Age Appropriate Design 
Code so that organisations offering online services used by children receive guidance that is appropriate to this rapidly 
evolving digital context. 


The Age Appropriate Design Code, as required by the Data Protection Act 2018, will advise on the privacy standard that 
organisations will be expected to adopt when offering online services that process personal data and are likely to be 
accessed by children. 


To inform the Code’s development, Revealing Reality was commissioned by the ICO to explore the views of parents, carers 
and children on a range of issues suggested by the government as areas for inclusion in the code.° 


Research objectives 


The research was designed to qualitatively and quantitatively explore what children, parents and carers think about a range 
of issues that the Government suggested should be addressed by the Code. 


The specific issues that the ICO was asked by the Government to consider including in the Code were: 


Default privacy settings 
Data minimisation standards 


[he presentation and language of terms and conditions and privacy notices 


Uses of geolocation technology 

Automated and semi-automated profiling 

Iransparency of paid-for activity such as product placement and marketing 
[he sharing and resale of data 

[he strategies used to encourage extended user engagement 

User reporting and resolution processes and systems 


The ability to understand and activate a child’s right to Erasure, rectification and restriction 


a 
a 
m 
m 
m 
m 
m 
m 
a 
a 
m The ability to access advice from independent, specialist advocates on all data rights 
m Any other aspect of design that the commissioner considers relevant 


To achieve this objective, the research set out to understand what children and adults think about how children’s personal 
data should and should not be used by Information Society Services*, and why this is important to them. This research 


sought to ensure that children of all ages and backgrounds were properly listened to and had their views considered. 


a 2018 https://www.childrenscommissioner.gov.uk/wp-content/uploads/2018/11/who-knows-what-about- 
me.pdf 
fcor hildren anc nts M y nd Attit rt 2( 
https://www.ofcom /assets/pdf_file/0020/108182/children-p. 
ti arliament.uk/lords/2017-12-11/debates/1 


ts-media-use-attitudes-2017.pdf 
54E7186-2803-46F1-BE15-36387D09B1C3/ 


j ( } | nttps://he 
DataProtectionBill(HL) 

https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/children-and-the-gdpr/what-are- 
the-rules-about-an-iss-and-consent/ 
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THE CHALLENGE: MAKING COMPLEX AND TECHNICAL TOPICS ACCESSIBLE AND RELEVANT 


To some extent, the challenges faced in this research reflect those faced by the ICO and online services. Getting people - 
especially children - to discuss or consider data use and make decisions about it is hard. Having done a great deal of 
esearch with both children and adults on their media and technology use and literacy in the past, a lot of thought was put 
into how to make the 11 topics accessible and engaging for children, and researchers spent time face-to-face with them, 
alking it through. Even then, the answers were sometimes contradictory, incomplete or ambiguous. 


The quantitative aspect of the research faced a similar challenge. It attempted to engage adults in a complex subject area 


with limited time for explanation or opportunities for researchers to probe ‘why’ they had made a decision or expressed 
a view. Furthermore, the survey was answered by parents and carers in relation to their children, not by the children 
themselves. This means the attitudes, perceptions and preferences identified must be analysed in the context of what 


children told us directly through the qualitative research. For this reason, the limitations of survey data will be discussed 


throughout the report, and survey questions will be caveated with thoughts on how they can be interpreted. 


Methodology 


METHOD OVERVIEW: A MIXED-METHODS APPROACH 


We used a mixed-methods approach to cover a wide range of views. This involved a mixture of qualitative and quantitative 
work with children and adults during November and December of 2018: 


Children’s qualitative research 
20+ focus groups speaking to children about how they felt their data should be used 


Children’s facilitated research 
Helped partner organisations use our research materials to talk to children and share the findings with us 


Adults’ qualitative research 
Used focus groups and intercept interviews to talk to parents and carers of children with additional 
needs about their children’s activities online 


Adults’ quantative research 
Online survey among 2002 parents and carers of children aged 3-17 across the UK to explore attitudes 
towards online data privacy 


Open-link survey 
Three online surveys (under 13s, 13-17 and adults) open for the public to complete, ensuring anyone 
who wanted to could contribute to the research 
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SAMPLE: COVERING CHILDREN, PARENTS AND We also spoke to parents and carers, including those who 
CARERS FROM A BROAD RANGE OF BACKGROUNDS have children with additional needs. 


n total, we spoke to more than 280 children across the In the adults’ quantitative research, a 15-minute online 


country through the qualitative and facilitated research. survey was completed by: 
We approached schools and other organisations across 
England, Wales, Scotland and Northern Ireland, enablingus  ™ 2002 parents and carers 


o speak to a broad range of children. m 992 male: 1010 


female 


n the children’s qualitative research, we spoke to: m 1098 18-44; 831 45+ 
m Nationally representative by regions 
(incl. Scotland and NI) 


m Equal split into 4 scenarios 


m 150+ children 
m 1:1 ratio of boys to girls 
m Children aged 3-17 


m 9 schools across the UK In the adults’ qualitative research, we spoke to: 


m 33 parents and carers 


m All parents and carers had additional needs, including: 


m Children with learning difficulties 


m Those with financial difficulties 


m Children with disabilities 


m Neurodivergent children including those with 
Autism and Asperger’s 


m 4 visits to organisations and schools in England 
Finally, the open-link surveys were completed by: 


m 108 adults 


m 3 children under 13 


. l m As the sample for this survey is both small and self-selecting 
In the children’s facilitated research, we heard from: 
- i.e. they have chosen to complete the survey due to an 


m 130+ children interest in the issue - the responses from the open survey, 
m 1:3 ratio of boys to girls when taken together, cannot be said to represent the 
m Children aged 7-16 views of the wider population. The quantitative analysis 


a 7 schools in England, Wales and Northern Ireland and commentary within this report therefore comes from 
the panel survey, as it was completed by a nationally 
representative sample of 2,002 parents and carers across 


the UK. However, a summary of the findings from the 


adults’ open-link survey can be found in the report Annex. 
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Research design: adaptable and engaging research materials 


DESIGNING MATERIALS SUITABLE FOR CHILDREN AGED 3-18 


There is no perfect way to test these topics - online concepts can be confusing for adults, let alone children. Research 
materials also had to be appropriate for children from the ages of 3-18, and so it was necessary to simplify the topics 

using concepts and language that even young children could understand. We therefore designed multiple versions of the 
research materials, each tailored to a specific age group. To make the subject-matter more accessible for younger children, 
we found it effective to use offline scenarios to communicate concepts initially, and then to relate these to online concepts. 


We developed five key topics which were then used to structure the direct and facilitated research. 


What is data? 
tanding what children think data actually is - the th that can be re ed about them 
nuch they know about the data they cre i i 


Who can see my data? 
; hildren know about who can access children’s personal data and who they think should be able to 
default privacy settings and what responder uld ex them to be 


out how data can be used 
o transparency of paid-for activity 
for extending user engagement 
the provider of the online se ) inform you 


‘fair’ in relation to Ja 
E ole default sharing settings 
rds automated decision making and targeted content/ads 


their data rights 
emoving data 


We used visually illustrated scenarios and storytelling to engage children and enable them to imagine different decisions 
they may have to make about their personal data, and these were adapted for those of different age groups. 


baL bidda cel pecigphe banaki fer abie Lò rer 
Aaji rere 


TOWARDS A BETTER DIGITAL FUTURE © REVEALING REALITY 2019 8 


RESEARCH LIMITATIONS 


Whilst this research enables us to report on what children say and think about the different ways their data is used, there 
are some limitations that must be considered: 


m This research did not examine children’s actual behaviour, so we are reporting on what they say rather than what 
they do 
m Children were interviewed in groups, in which they may have tended to agree with what others were saying rather 
than stating their own opinion 


m Children were interviewed in school and often repeated things that their teachers/parents had told them, which 


they knew to be the ‘right’ answer, but may not have necessarily done or believed 
m As children’s understanding and experience of some of the topics are limited, hypothetical scenarios and situations 
were used, which enabled researchers to infer their views on the topic. In this way, we were able to find the best 


possible proxy for exploring their understanding and views of these topics 

m Children tend not to have a clear world view, which meant that there could be a different response depending on 
how the question was asked. As a result, there were often contradictions in what children were saying, depending 
on the framing of the question 


SURVEY DESIGN 


A key detail of the survey used in the adults’ quantitative research was that it was designed to collect attitudes among 
parents and carers in relation to their children, rather than directly from children themselves. As such, it is important 
to remember when analysing and interpreting the results that behaviours and levels of understanding are based on 
assumptions parents and carers make of their children. 


Specific elements of the survey design were intended to improve the understanding of respondents and the accuracy of 
the data collected. Firstly, each respondent was placed into one of four scenarios in which their child was signing up to 
and using a different type of online service. The scenarios allowed us to place the respondents in a series of hypothetical 


situations, meaning we did not have to rely on their personal experiences for them to be able to answer certain questions. 
The scenarios also allowed us to test whether people's attitudes towards their child’s data privacy were affected by the type 
of ISS they were thinking about. 


Within the survey we also included visual stimulus, tailored to the scenario, to help people visualise the concepts we were 
asking about - for example, how adverts might look with different types of label on. 


This survey, used in the adults’ quantitative research, was also used for the adults’ version of the open-link survey, which 
was made public for any parent or carer who wished to contribute to complete. Shorter open-link surveys were specifically 
designed for children wanting to share their views, combining materials from the adults’ survey and children’s direct and 
facilitated research packs to create specific surveys for children aged under 13, and 13-17. 


A key set of questions in the survey revolved around default privacy settings. This covers a number of areas (not just default 


settings) so is referred to at multiple points throughout the following sections. When we say “off by default” we mean that 
% of the sample said that data use should be turned off when a child first uses an ISS. 


na 


We also use terms such as “acceptable”, “appropriate” and “okay” to describe how people respond to wider themes - in 


these instances we mean that people were answering about them more favourably. For example, saying something should 
be on by default, or less likely to disable an option as a setting altogether. 


A note of thanks 


This research would not have been possible without the support of the parents, carers and children who generously 
volunteered their time to speak to us and share their views and experiences. Further thanks go to the teachers and group 
leaders who kindly organised and facilitated group discussions on our behalf, enabling pupils across the UK a chance to 
have their voice heard. 
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Themes and tensions 


n addition to exploring children’s and parents’ understanding of and attitudes toward a range of specific data privacy topics 
identified by the government, the research uncovered a number of broader themes. These themes directly influenced how 
children and parents thought - and also how their answers can be interpreted. It is likely that an effective Code - one that 
both protects and empowers children - will need to address these overarching themes, as well as people’s attitudes and 
expectations around specific types of data collection, use and sharing. 


The research identifed the following themes: 
Children and their parents and carers wanted to use online services. 


m The fear of missing out often outweighed concerns over data privacy 


m Children, parents and carers were generally aware that there is a trade-off between sharing data and using services 
m People’s current behaviour and attitudes shaped their views on the future of data privacy 


m Social and personal consequences of personal data misuse were more of a concern than commercial consequences 
This is a challenging issue to resolve and there is no simple solution. 


m Views were often inconsistent, and were influenced by how questions were framed 

m Age did not seem to play as large a role in influencing the attitudes and understanding of children and their parents 
as you might expect 

m Choice was important, but providing more information did not necessarily help children to make decisions about 
trade-offs 


Children and their parents and carers wanted to use online services 


This incredibly simple point is also incredibly important. The websites, apps, services, platforms that we explored with 
children, parents and carers are, more often than not, services that people want to use. This meant that children, parents 


and carers were generally willing to compromise on any concerns they had over sharing personal data in order to gain 
access to the functions and features of a platform or website. This specific point manifests itself in a number of overarching 


observations about how and why people of all ages responded to questions and scenarios in the ways they did. These 


observations are discussed below. 


THE FEAR OF MISSING OUT OFTEN OUTWEIGHED CONCERNS OVER DATA PRIVACY 


Although children wanted to feel safe and secure online, many also feared missing out on using online services, particularly 
platforms and websites/apps that their peers were using. Many felt they had to make a binary choice between maintaining 
privacy and keeping up with their peers. Faced with this choice, children were inclined to disregard concerns they had about 
how their data might be used. 


This type of decision-making was especially evident in discussions around terms and conditions and privacy notices. While 
most children talked extensively about how they valued their online privacy, few had read the terms and conditions or 


privacy notices of the platforms and websites they used. Instead - believing they had to choose between either agreeing 
o the terms and conditions or missing out on the benefits of the service - many agreed to the terms without reading them, 
and in spite of their concerns. 


Discussions around cookies revealed a similar, if not more extreme, example. While the perception was that children would 
be facing a similar decision - to accept cookies or to not use a website - the reality was starker: children didn’t even see it 
as a choice, and the idea that they wouldn't use the website was not even considered. What they knew about cookies was 


hat you had to accept them to use a website. 
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“They [terms and conditions] are long, boring and I never read them. But 


you ve got to accept them” 
13-15-year old, Essex 


“I wish you didn't have to accept them [cookies]. But realistically you just do” 
13-15-year old, Derby 


“I don’t know exactly what cookies are, but I see them all the time” 
10-12-year old, London 


Not all children felt they had to choose between their privacy and using online services. Some had developed strategies 

to allow them to use services without sharing personal information they wanted to keep private. Many, for example, were 
using false names and ages when signing up to services. In some cases, children would lie about their age (pretending to be 
older than they were) to gain access to platforms in the first place. 


“When I’m gaming I'll use a fake name unless I’m playing with just my friends” 
13-15-year old, Derby 


Others believed that they could limit the effect of cookies, mentioning apps that block or clear them. 


“There’s this app called Seed Killer that attaches a virus to 
the cookie and then sends it back to the company” 
13-15-year old, Edinburgh 


Most children had turned their Snap Maps to Ghost Mode, in order to prevent their location from being shared. 


Turning Snap Maps to Ghost Mode is an example of a well-known setting that is easy to change, which also has tangible 
implications as far as children are concerned. It was one of the most used strategies to combat the tension between privacy 


and missing out. 


“Using Snap Maps without Ghost Mode is the best way to get stalked” 
13-15-year old, Edinburgh 
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In general, however, children used these strategies inconsistently and often only in very specific contexts (such as when 
using Snapchat). Moreover, this practice of restricting the information they directly gave to platforms was not necessarily 
the solution children thought it was. They were often a lot less aware of the indirect ways that platforms were collecting 
data about them, meaning children were simply sharing personal data (e.g. preferences, browsing data etc.) under a false 
assumption they had protected themselves. 


CHILDREN, PARENTS AND CARERS ACCEPTED THAT THERE IS A TRADE-OFF BETWEEN SHARING DATA 
AND USING SERVICES 


Whilst the outcome of this point is similar to the point above - that children and parents seemed happy to exchange 
data for access to services - there is an important distinction between this and the previous theme. As the above makes 
clear, the fear of missing out can lead to indiscriminate waiving of data privacy. By contrast, the broader idea that people 
understand and accept there is a trade-off also tells of more active, conscious choices about the data people are willing 
to share. 


There was broad acceptance and understanding that trade-offs had to be made between sharing data and using services. 
For example, where children could see there would be a direct benefit to them, they were happy to share their data. 


This was evident in discussions around who children were happy to share their address with. Whilst most were 


instinctively reluctant to share this information - as they worried that it could be used to rob or kidnap them - there was 
a broad acceptance that trusted parties like doctors should know their address so that they could assist them in the case 
of an emergency. 


This trade-off can best be understood by exploring how data is used, rather than simply if it is. When describing the 


different things personal data can be used for by ISS, parents and carers were very open to their children’s data being used 
for a range of purposes. From ‘easy wins’ where you would expect only the staunchest advocates of data privacy to object 


to the data being used in a certain way (e.g. used for “keeping your child safe online”), to more contentious issues such as 
personalisation of services, content and advertising, parents and carers were largely open to the use of their child’s data, or 
at least divided on the issue. 


There was an inherent tension here, however. While children and parents were open to data being used in various ways, 
they were not necessarily aware of what data they were sharing and how it was being used. As mentioned, this was 


particularly true when it came to sharing data in less direct ways, such as through the use of cookies or browsing data. 


PEOPLE’S CURRENT BEHAVIOUR AND ATTITUDES SHAPED THEIR VIEWS ON THE FUTURE OF DATA 
PRIVACY 


Sharing personal data when using online services - and having it collected in numerous ways from numerous sources - is 
commonplace today. As such, the exchange of personal data for services is ‘normal’ to most parents, carers and children. 
Because these attitudes are often deeply ingrained, it can make it difficult for people to imagine other situations or 
solutions, i.e. what data sharing and data use could be like for children in the future. 


“Whenever it [enabling location services] pops up, I just 
accept straight away. I don’t think twice about it” 


10-12-year old, London 


Parents and carers’ current behaviours when using online services were also likely to influence how they responded to 
questions about their children’s data privacy. People are likely to rationalise their own online behaviours and assume that 
their behaviours are not inherently ‘risky’ or might have negative consequences they hadn't considered. If they are happy 
receiving personalised content recommendations on music streaming sites, for example, then why shouldn't their children? 
They may take a different view when it comes to their alcohol consumption, but data privacy and sharing simply do not 


have the same obvious, tangible impacts - a point we will cover in due course. 
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SOCIAL AND PERSONAL CONSEQUENCES OF DATA MISUSE WERE OFTEN OF MORE CONCERN 
THAN COMMERCIAL CONSEQUENCES 


Children were mostly concerned with protecting themselves from immediate, tangible harm. When discussing the types 
of data they felt comfortable sharing, many described the dramatic consequences that might stem from sharing data that 
identified or located them. Children of all ages spoke of the risks of being stalked, kidnapped, cyberbullied or robbed if they 
shared information like their address or name online. 


“Share your data if you're looking for a wee stalker” 
13-15-year old, Edinburgh 


By contrast, few raised concerns about sharing less tangible forms of data, such as their browsing histories. Most children 
struggled to imagine the harm that might stem from these types of data sharing, and those who could tended to describe 
comparatively mundane consequences. 


“Cookies might show my mum what I was going to buy her for her birthday” 
13-15-year old, Edinburgh 


In general, children focused on how their data might be misused by individuals, rather than how a company might do so. 


“I don’t really mind what’s on social media...as long 
as it doesn’t turn into physical bullying” 
10-12-year old, Derby 


Parents and carers had a similar attitude. Those who responded to the survey tended to be more concerned with 
protecting their children from peer-to-peer interactions on various services than preventing their data from being used to 
personalise, recommend or predict behaviour. See Default Settings for a full breakdown of survey responses on this topic. 
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This is a challenging issue to resolve and there is no simple solution 


People’s views on data privacy topics were shaped by a number of practical factors. 


Differentiating between acceptable and unacceptable forms of sharing and using children’s personal data requires a broad 
understanding of a wide variety of issues, ranging from the types of data involved to the purpose of the data usage or 
sharing. But despite this need for knowledge, in conversations on topics like terms and conditions, privacy notices and 
cookies, people often described feeling overwhelmed by large amounts of information on data privacy topics. 


This suggests that simply providing more information to people is not necessarily the answer when it comes to ensuring 
hey are making informed decisions about their personal data. 


Throughout this research, the difficulties in discussing data privacy topics with people - both adults and children - became 
increasingly clear, as did the fact that their perceptions can be influenced a range of factors. The following section outlines 
he key challenges faced by the research. These challenges both provide further context to be taken into consideration 
when designing the Code, and also represent important factors to bear in mind when interpreting the research findings. 


VIEWS WERE INCONSISTENT AND WERE INFLUENCED BY HOW QUESTIONS WERE FRAMED 
As already noted, children and parents and carers provided different responses to different scenarios relating to the use of 
their (or their child’s) personal data. These examples highlight many of the inherent contradictions in how people viewed 


data sharing issues. 


The way in which questions were framed affected how people answered them. This effect was especially visible in the 
comparison between the answers people gave when they were given free choice, and those they gave when they had to 
choose between two potentially imperfect options. 


For example, when given the option of choosing between children seeing personalised ads or “random” ads, many 
favoured personalised ads. Yet when asked more broadly whether they would be happy for personal data to be used to 
provide personalised adverts, many had negative reactions. Even when people were accepting of the trade-offs between 
sharing data and accessing services, they could still respond negatively to open scenarios in which there were no apparent 


consequences (such as not being able to use, or having to pay for, an app). 


The specific language of the questions also influenced people's responses. In the above scenario, for example, “targeted”, 
“tailored”, “personalised” all refer to the same type of advert but have different connotations - with the former notably more 


negative and evoking a greater sense of pressure than the latter two. 


Another important distinction - one particularly evident within the parents and carers survey - is how attitudes towards 
different types of services can impact attitudes to how they use data. In the survey, parents and carers were provided with 
four different scenarios that formed the basis for a range of questions about their child’s data privacy: a social media site, 

a music streaming service, a video streaming service and an online game. On many questions, the scenario would impact 
he responses, and many of these distinctions are highlighted within this report. In general, the scenarios demonstrated 
an important trend: people were considering the intended purpose of the ISS in question when answering. Peer-to-peer 
interaction, although less acceptable overall, was seen as more appropriate in the context of social media and an online 


game than either music or video streaming. In contrast, personalisation of content was far more acceptable when it came to 
music or video streaming (e.g. recommendations for bands you might like based on your current listening). 
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AGE WAS NOT THE ONLY FACTOR INFLUENCING THE ATTITUDES AND UNDERSTANDING 
OF CHILDREN AND THEIR PARENTS 


Children’s age did not necessarily define how they - or their parents or carers - perceived or understood issues around 
data privacy. The research uncovered the following trends: 


m Older children in the direct research were not consistently more knowledgeable, capable or privacy conscious than 
younger children 

m The age of the child that parents and carers were answering questions about in the survey did not always 
determine how they answered 


Some older children had a better understanding of the topics included in the research, but this was not always the case. In 
many instances it was apparent that the children’s parents and schools played a larger role in shaping their understanding 
and attitudes than did their age. This was especially evident in discussions about cookies, where a number of younger 
children in select schools had a significantly better grasp of the topic than older children at other schools. 


This difference in understanding also meant that many children knew more, or were able to think more critically, about data 


privacy issues than expected. Stimulus for the direct research had been created with different age and school year groups 
in mind, but the research team found they were able to move ‘up’ a level of complexity with many of the groups. 


PROVIDING MORE INFORMATION DID NOT NECESSARILY HELP CHILDREN MAKE DECISIONS 
ABOUT TRADE-OFFS 


Above everything, the research found that people valued choice. Whilst high privacy tended to be a more acceptable 
default position than low privacy, people wanted to be able to choose this option. 


For children to make informed choices they need to be empowered to do so. This does not, however, necessarily mean 
providing them with more information. The direct research with children found that the more information children 
were given, the harder they found it to engage with the process and make decisions about what was and was not an 
acceptable trade-off. 


The responses of children to terms and conditions and to cookies are good examples of this. The way the information is 
presented, the assumption that it has to be accepted, and the lack of understanding about what it really means, all combine 


o create a situation where the sheer volume of information disempowers children, providing them with a seemingly binary 
choice between using and not using a service. 


The real challenge in empowering children to make informed decisions about how they share their data is in being 
able to appropriately engage children with relevant information and provide the right opportunities for them to change 


heir options. 
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THE 11 TOPICS 45 


The 11 topics 


As discussed in the method section, the 11 topics were mapped onto five key questions, as shown in the table below, 
which were used to structure the research materials. 


What is data? 
a of t 
d profiling 


ctivity such as product placement and marketi 


How can data be used? 


m ira cy of paid-for a such as product placement and marketing 


e extended user en ament 


How 
m Def 
m Da 
>», rectification and restriction 


What if you’re not happy? 
and tio 


This section covers the findings from each of the 11 topics. Each topic is structured in this way: 


Children’s qualitative research and children’s facilitated research findings 


Adults’ quantative research 


Adults’ qualitative research 


For information on some further context and sub-group trends that came out of the adults’ quantitative research findings 
(see annex 1). 


CHILDREN S 
QUALITATIVE 


RESEARCH 


CHILDREN S 
FACILITATED 


RESEARCH 
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Use of geolocation technology 


CHILDREN OF ALL AGES DISLIKED THEIR LOCATION BEING SHARED WITH PEOPLE 
THEY DID NOT KNOW AND TRUST 


Younger children were open to sharing their location with a limited selection of parties (often their parents) on occasions 
when they felt it benefited them. Some, for example, thought sharing their location with their parents could help keep them 
safe. Others felt that trusted adults like doctors and teachers should also be able see their location, as they were able to see 
the direct benefit of this, as highlighted in the quotes below. 


“My doctor should know where I live so they could 
come and make me better if I was ill” 
3-5-year old, Swindon 


“Your teacher might need to know where to send your homework” 
6-9-year old, Swindon 


In general, however, young children were fearful of the consequences of sharing their location. All agreed - often 
emphatically - that strangers should not be able to see where they were, as they feared that this information might be 
used to rob, kidnap or cyberbully them. It is worth mentioning that in the interviews with younger children, we spoke about 
sharing their home address rather than their exact location, which may have heightened the fears of being robbed 

or kidnapped. 


“They might break in. Or they might be mean to you” 
3-5-year old, Luton 


“Your address is the worst thing you could possibly say to someone online” 
10-12-year old, Cardiff 


There was some disagreement over whether companies should know their location - in large part, because many struggled 
to understand how companies might use this information. Moreover, many younger children found it hard to differentiate 
between companies and strangers, meaning they were reluctant to trust them. On the whole, however, most children 
differentiated between local shops (which they trusted to use their address for deliveries) and larger companies like 
YouTube (which they were less likely to trust). 


“If YouTube knew my address, they might start posting nasty things about me” 
6-9-year old, Swindon 


“YouTube shouldn't know where I am — they might hack me” 
6-9-year old, Luton 


Older children had similar concerns about their location being used to attack or rob them. Most had, for example, switched 
their Snap Maps to ‘Ghost Mode’ to hide their location. 
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“Using Snap Maps without Ghost Mode is the best way to get stalked” 
13-15-year old, Edinburgh 


Similarly, when discussing creating hypothetical social media profiles, almost all said they would not provide their address, 


fearing that this information could be misused by strangers. 


n contrast to younger children, however, older children were less concerned about their location being shared with large 


companies and platforms like Facebook, YouTube or Instagram. 


They had a better understanding of the potential benefits of this type of information sharing - noting, for example, that 
geolocation technology could help them find lost phones, or let their parents know that they are safe. They also tended to 
be more trusting of larger companies, feeling it would be hard for them to misuse information about their location. 


“As long as the data resides in the site and isn't shared, I’m happy with it” 
13-15-year old, Essex 


“What’s the chance of someone going hmm let’s go 
on her iPhone and see what she’s doing” 


13-15-year old, Essex 


“Facebook are hardly going to come and burgle your house” 
13-15-year old, Derby 


MANY WERE LESS AWARE OF THE INDIRECT WAYS THEIR LOCATION COULD BE TRACKED 


While most - and especially older children - knew that their location could be tracked, few understood the range of 
methods by which this could be done. Often, children had experienced geolocation technology in a narrow set of contexts, 
such as when using Snapchat or when taking photos on their phones. This meant they were unfamiliar with many different 
forms of location tracking. Many, for example, felt that platforms like YouTube had learned their location not through 
indirectly tracking it, but rather through either user input or educated guesses (such as the language the child used). 


“Twitter knows where you are because you have 


to enter a postcode to register” 
13-15-year old, Swansea 


Similarly, few knew what IP addresses were, or how they could be used to track location. 


And once the full range of location-tracking methods were explained to them, many reported feeling uncomfortable 


and uneasy. 


“Yeah see this is why I feel uncomfortable. Thanks for telling me that” 
13-15-year old, Essex 


“Its creepy. It’s an invasion of privacy” 
13-15-year old, Essex 
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“Its weird. I've never actually thought about it before” 
16-17-year old, Edinburgh 


GIRLS TENDED TO WORRY MORE THAN BOYS ABOUT SHARING THEIR LOCATION 


While many boys had concerns about their location being shared widely, their concerns were often different from those 
held by girls and tended to be expressed less emphatically. By contrast, many girls had experiences of receiving unsolicited 
messages on social media from strangers asking to meet up. This made them especially wary of sharing their location. 


“What if these people had stalker intentions?” 
16-18-year old, Dover 
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SCENARIO TOTAL 


SAMPLE 


®, 


SOCIAL MEDIA 501 


@ 


MUSIC STREAMING 505 


VIDEOSTREAMING 498 


ONLINE GAME 498 
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Parents and carers found the concept of geolocation data being used by the online services their children were on to be 
an issue of upper-middling concern. More than seven in 10 (71%) thought that geo-recommendations (“using location to 
make recommendations (e.g. suggest places they may want to visit)”) should be off by default across the scenarios - this 
placed it seventh in a list of 16 where the top answer, for comparison, was “letting other users contact your child” (81% 
saying this should be off by default). Figure 1 below shows how the results break down across the four different scenarios: 


FIGURE 1 - GEOLOCATION RECOMMENDATIONS BY DEFAULT 


Q14.3 - Please say whether you think each of the following things should be on or off by default when your child first gets an 
account: “Using location to make recommendations (e.g. suggest places they may want to visit)”. 


BY DEFAULT 


° 


30% 70% 


33% 67% 


25% 75% 


27% 73% 


A NOTE ON SURVEY DESIGN: 


It is worth noting the differences between scenarios are likely caused by the slight differences in wording of this specific 
question, designed as it was to fit within each scenario. For instance, in scenario 2 the example was “suggest local concerts 
they may want to go to”, while in scenario 3 the wording was “suggest videos filmed in the same area” - these two 
suggestions Vobviously have slightly different connotations and potential outcomes. 
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When thinking about more specific examples of how geolocation data can be used, however, some nuances were 


uncovered. On the whole, parents and carers felt that keeping tabs on their own children was okay (59% said this function 


should be on by default), while every other use was far less acceptable (see Figure 2 below). 


FIGURE 2 - TYPES OF GEOLOCATION DATA USE 


Q38 - for each of the following ways the site might use your child's location data, please say whether you think they should be “on” or 
“off” by default in the settings when your child first starts using the site/app. 


Q39 - those settings that should not even be given to children as options (question asked of just those saying off to that fact but 


re-based on all). 


TOTAL SAMPLE 
2,002 


To let you know where 
your child is 


To let them know about things 
they may be interested in nearby 


To provide location-specific 
alerts (e.G. Weather 
warnings) 


To let your child’s friends 
know when they are nearby 


To prompt them to ‘check-in’ 
at an event/location so other 
people can see where 

they are 


To target them 
with adverts 


To share their location with 
other apps, websites, games 


A 


59% 


39% 


39% 


ba 


BY DEFAULT & 


81% 


3% 


73% 


75% 


61% 


61% 


SETTINGS SHOULD 
NOT EVEN BE OPTIONS 


41% 14% 


19% 


17% 


ie) 
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A follow-up question was asked to determine whether parents and carers thought settings that shouldn’t be open to 
children should be options on sites/apps at all. Here, relatively high proportions said many simply should not be selectable 
(highlighted in yellow on Figure 2): 


To share their location with other apps, websites, games (50%) 


To prompt a child to ‘check-in’ at an event/location so other people can see where they are (43%) 


To let your child’s friends know when they are nearby (35%) 
To target them with adverts (34%) 


It is worth noting that the first of these is relatively ambiguous - sharing data with other sites generally is seen negatively, 
and in this particular case is not qualified with a specific use. 


These answers demonstrate a pattern that we see in other areas of the research of people seeing person-to-person 


interaction as less acceptable than more commercial uses such as providing location-specific alerts (e.g. weather warnings) 
or letting [the child] know about things they may be interested in nearby (e.g. a park, cinema etc,). 


PARENTS AND CARERS OF CHILDREN WITH ADDITIONAL NEEDS SAW GEOLOCATION TECHNOLOGY 
AS A DOUBLE-EDGED SWORD 


On the one hand, they saw it as a tool they could use to monitor their children and keep them safe. 


“T use it [geolocation services] to track my kids when they're walking to school” 
Parent of autistic child, London 


On the other hand, they saw it as something that could put their child in danger if other people could access their 
child’s location. 


“Me or her switching off location services on our phone is not 
the end of the story. I’m sure someone could still find her” 
Parent of child with ADHD, London 


Because of this tension, parents and carers of children with additional needs reported that they closely monitored their 
children’s use of geolocation technology. Many had either asked their child to turn location services off on their phone or 
had switched it off themselves. They also tried to limit their children’s usage of apps and websites that they associated with 
geolocation technology, such as Snapchat. 
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Automated and semi-automated profiling 


CHILDREN WERE FAMILIAR WITH THE OUTCOMES OF PROFILING, BUT WERE GENERALLY UNAWARE 
OF HOW IT WORKED 


ost children - especially those who were older - had experience with the outcomes of profiling. Children talked about a 
range of outcomes, including videos that were recommended to them on YouTube and search engine suggestions. 


evertheless, few understood the process of profiling and the various mechanisms involved. To a great extent, this can be 
attributed to the fact that children were less aware of data that platforms and websites collected indirectly. This proved 
especially apparent in discussions about cookies - one of the mechanisms that could be used to profile users. Whilst many 
had heard of cookies, few knew how they could be used to build up a profile of them. 


“I don’t know exactly what cookies are, but I see them all the time” 
10-12-year old, London 


‘Tve heard about [cookies] but I don’t know they are” 
13-15-year old, Derby 


This meant that children often struggled to understand how profiling had been used to generate things like YouTube 
recommendations or targeted ads. 


CHILDREN’S ATTITUDE TOWARDS PROFILING DEPENDED ON ITS OUTCOME 


When profiling was discussed in terms of content recommendations, most saw it in a positive light, seeing it as convenient 
and a time-saver. Children saw it as something that could reduce the amount of time they had to spend browsing when 
looking to purchase things or when looking for new forms of content and entertainment. 


A few worried that recommendations could reveal personal and embarrassing information about them. This was particularly 
the case when children shared devices with other members of their family. In Edinburgh, for example, one child worried that 
recommendations on Amazon might reveal the birthday present he had bought for his mum. 


“Its a bit freaky being constantly reminded of 
something you only looked at once” 
16-17-year old, Swansea 


In general, however, children were positive about profiling when it was discussed in this light. 


“They [recommendations] are quite useful to be honest” 
16-17-year old, Swansea 


By contrast, many saw profiling in a negative light when the conversation moved to talking about targeted adverts. 


Children of all ages spoke about feeling “used” by advertisers and suggested that they would prefer that their data was 
not used for profit. 


mportantly however, older children proved more willing to accept targeted advertising than younger children were. 


Younger children were generally strongly opposed to being shown targeted advertisements, feeling that they were designed 
o promote reckless spending. 
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“They could grow you into temptation” 
6-9-year old, Luton 


“Youre just going to waste your money” 
6-9-year old, Cardiff 


Older children, on the other hand, understood targeted advertisements as the price they had to pay to use certain 
online services. 


“Sometimes I feel a bit used for my money, but I know 
companies might need them to survive” 
13-15-year old, Swansea 


CHILDREN WERE MORE CONCERNED ABOUT THE CONSEQUENCES OF AN INDIVIDUAL MISUSING 

THEIR DATA THAN THIS BEING DONE AUTOMATICALLY 

Although some children disliked the idea of automated decision making - often describing it as creepy and worrying that 
it might be misled by inaccurate information - most trusted algorithms and computers to make better, more accurate 
decisions than humans. 


Most found it harder to imagine the negative consequences of automated decision making, especially in comparison to 


better understood risks such as their location being used to rob or kidnap them. 


“Most of [my data] automated, so no one person is really looking at it” 
13-15-year old, Essex 
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Many of the questions in the survey relate to the broader issue of profiling and automated decision-making as all of the 
data uses indicate, to some extent, that profiling would occur. Profiling is a particularly challenging area for people to 
understand in and of itself within a survey context, and largely only seems like a tangible subject when considered in 
relation to the outcome of that process. The moral question of whether an algorithm should be able to make decisions 
about a person by using their personal data is difficult to engage with outside of this context and, as such, did not feature in 
any real detail within the survey. 


Taking specific uses of data as a proxy for people's level of comfort with profiling, however, suggests that parents and carers 
are not overly concerned by the issue - acceptance of things such as personalised content, for example, is high, with over 
half of parents across each scenario saying “suggesting personalised or targeted content” should be on by default 

(Scen.1 = 52%; Scen.2 = 75%; Scen.3 = 64%; Scen.4 = 51%). 


PARENTS AND CARERS OF CHILDREN WITH ADDITIONAL NEEDS HAD MIXED OPINIONS ON PROFILING 


Some saw profiling as having benefits for their children. YouTube recommendations, for example, were seen as especially 
convenient, while others valued their children being shown educational content online. 


Others - especially parents and carers of neuro-atypical children - saw profiling as problematic. They noted that 
neuro-atypical children often struggle to express themselves when using search engines, meaning that they frequently 
access content that they weren't looking for. As such, they worried that platforms and websites would be recording 


information that didn’t accurately reflect their children’s wants and might profile them on this basis. A number of parents 


and carers of neuro-atypical children reported having inappropriate content advertised to their children based off these 
accidental searches. 


“My daughter asked Siri to search for Peppa Pig 
but instead it searched for porn” 
Parent of an autistic child, London 
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Sharing and resale of data 


YOUNGER CHILDREN WERE PRIMARILY CONCERNED ABOUT BEING IDENTIFIED, AND TENDED 
TO SEE DATA SHARING IN BLACK-AND-WHITE TERMS 


At a young age, many children struggled to distinguish between strangers, who may want to misuse their data to cause 
harm (e.g. theft and online bullying), and companies/online platforms. This meant they were less trusting of online platforms 


and therefore were only happy to share information that they felt they couldn't be identified from (e.g. their favourite toys 
or first names). 


“There might be millions of Ollie’s out in the world” 


6-9-year old, Cardiff 


‘Td like people to know my favourite toy... people 
won't know who I am if they know that” 


6-9-year old, Cardiff 


“If the kid’s stupid enough to share his personal information, done” 
10-12-year old, Derby 


Younger children were also more likely to see different types of data sharing as ‘good’ and others as ‘bad’ and thought less 
about how context might affect whether data sharing was beneficial to them or not. For example, there was a general 
consensus that sharing information like your home address or school was always a bad thing. A few children in the youngest 
group, aged 3-5, even questioned whether their friends should know their address, illustrating the black and white thinking 
about what data they feel they should and shouldn't share. 


“That [address] is the worst thing possible to share with someone online” 
10-12-year old, Cardiff 


“He probably wouldn't be ok with personal information like where he lives 


and stuff, but I think he might be ok with his gender and his first name” 
6-9-year old, Luton 
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SOME YOUNGER CHILDREN WERE ALSO WORRIED ABOUT COMPANIES KEEPING THEIR DATA 
FOR PROLONGED PERIODS OF TIME 


Some younger children were anxious that data was being kept as they feared this could lead to someone else getting it or 


finding information about them. 


“I wouldn't be happy with someone I didn’t know or didn’t trust having my 
personal information written down in a notepad where they could store 
it and go back and remember it because they could do something with it” 
6-9-year old, Luton 


Children felt this was particularly concerning when companies might have access to information about them could be 


embarrassing or make them look bad. 


“If you bought a babyish toy, it could be embarrassing, and 
you could be embarrassed for the rest of your life” 


10-12-year old, Cardiff 


“People could see bad things about you, like if I snatched a toy” 
3-5-year old, Swindon 


OLDER CHILDREN HAD MIXED VIEWS ON HOW TRUSTWORTHY PLATFORMS ARE, AND WERE BETTER 
ABLE TO UNDERSTAND THE NUANCE IN DATA SHARING 


In contrast, older children had a more nuanced understanding of the benefits of data sharing, as they were able to 
understand that different people should have different levels of access to your data dependent on the purpose of their 
access (e.g. government for safeguarding, or search and purchase history being used by Amazon to show what is trending). 


However, there were still conflicting views on whether or not to trust online platforms, and whether they ways they were 


using data would be positive or negative. 


“When Google asks you to save your password for the site 
you say no, you click never...because you don’t want anyone 
having your passwords, especially Google cos they'll sell it 
to anyone that offers them any amount of money” 


13-15-year old, Edinburgh 


“Most trusted sites like Google or Facebook should be able to 
keep data, I doubt they would do anything with it” 
13-15-year old, Edinburgh 


“Its important they [the NHS] have access to medical 
history, it’s for a specific purpose” 
16-18-year old, Swansea 
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“The government should see everything to help safeguard people” 
16-18-year old, Edinburgh 


CHILDREN DID NOT ALWAYS FEEL IN CONTROL OF THE DATA PLATFORMS HELD ABOUT THEM, 
AND WORRIED ABOUT THIRD PARTIES ACCESSING DATA WITHOUT THEIR PERMISSION 


Children of all ages disliked the idea of not knowing who had their data and were clear that they needed to give explicit 


permission for a platform to sharing data with someone else. 


Younger children felt that they needed to know and trust the person/organisation that information was being shared with 
and used the example of the research as an illustration of how data sharing should work. 


“Because you've come to see us and youve asked us 


if it’s ok to do it, we know we can trust you” 
6-9-year old, Luton 


Older children often worried that they weren't aware of all the data platforms held about them, and that they didn’t know 
when it was being shared with third parties. Some children wanted to be provided with more live updates on when and 
who their data was being shared/resold to, not just during sign up when they first accessed the platform. It was currently 
seen as difficult to access this kind of information. 


“I think permission is important, you should know what data they’re holding” 
13-15-year old, Derby 


‘Tm always worried about like third parties” 
13-15-year old, Essex 


A NOTE ON SURVEY DESIGN: 


As children found it hard to understand the commercial consequences of sharing their data, the conversations, especially 
with younger groups, tended to focus on sharing data directly to a platform or organisation, rather than the company then 
reselling/sharing their data with other organisations. However, given the adverse reaction children had to people they didn't 
know and trust accessing their data without their knowledge or permission, it can be inferred that children are concerned 
about companies reselling/sharing their data. 
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SHARING DATA WITH THIRD PARTIES IS GENERALLY SEEN AS A NEGATIVE BY PARENTS AND CARERS 

People are largely against sharing data with third parties by default, although the reason for sharing data does play a part 
in how people respond. Around eight in 10 (82-84%) parents and carers across the scenarios think sharing data with third 
parties so they can “target [their] child with advertising material” should be off by default. While this reduces to almost 
seven in 10 (71-73%) when thinking about sharing data with third parties to “help them develop new apps’, the general 
mood is still against the concept. 


PARENTS AND CARERS OF AUTISTIC CHILDREN FELT IT WAS PARTICULARLY HARD TO EXPLAIN 
THE NUANCE IN SHARING PERSONAL DATA 


Parents and carers of autistic children felt it was easier to get their children to see data sharing in black and white terms - 
i.e. that they should never share any personal data, as their children found it difficult to understand nuance. 


‘Tm terrified of my daughter sharing things online” 
Parent of an autistic child, London 
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Default privacy settings 


CHILDREN OF ALL AGES FAVOURED HIGH PRIVACY SETTINGS BY DEFAULT 


Younger children (aged 3-12) were not asked directly about default privacy settings. Their preferences, however, can be 

inferred from their opinions on how their data should be shared and who it should be shared with. Most believed that their 
data should not be shared without their - or their parents’ - explicit permission. When discussing a scenario in which their 
eacher had uploaded an embarrassing picture of them to the internet, for example, a number suggested that their parents 
would be angry as they hadn't given permission for pictures of their child to be posted onl 


ne. 


For some children, this concern with ensuring that data was not shared without permission extended to other people’s 
data. Some worried that they could reveal information like their best friend’s name by mistake, without getting their 
friend’s permission. 


“You shouldn't give out someone else’s personal information. They might feel betrayed” 
10-12-year old, Cardiff 


Older children (aged 13+) were asked directly about their views on default privacy settings. They generally favoured having 
privacy settings set as high by default for all their personal data, with some suggesting that this would help them feel in 
control of their data again. 


“Everything should be set to private and then you 
can change it for what you want to share” 
13-15-year old, Edinburgh 


“This would stop you accidentally revealing data” 
13-15-year old, Essex 


When pressed, some conceded that there might be negatives to having all their personal data hidden by default by high 
privacy settings. They noted that - if their names were hidden - it would be hard for their friends to find them on social 
media or gaming platforms. Similarly, a few felt they might miss out on some of the benefits of data sharing, such as tailored 
content and recommendations. 


On balance, however, these children felt that the benefits of high default privacy settings outweighed the costs. Moreover, 
many other children could not think of any negatives to high default privacy settings. 


MOST FELT THAT WEBSITES AND PLATFORMS SHOULD DO MORE TO BRING PRIVACY SETTINGS 
TO THEIR ATTENTION 


Older children felt that they - and their peers - were badly informed about their privacy settings. They worried that this 
meant that they were sharing more information than they wanted to, often with unknown parties. 


“You can control it [data sharing] to a certain degree, but there’s 
a lot that’s hidden from us and you have to go through all these 


settings to find out what they've actually collected” 
16-17-year old, Swansea 


Many suggested that websites and platforms could make them more aware of their privacy settings by forcing them to 
engage with them when they first used an online service. 
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Default settings featured significantly in the parents and carers survey, acting as a key feature within the scenario-based 
section of the questionnaire. It provided an opportunity to explore attitudes towards a range of data uses, as well as more 
general attitudes towards the role of default settings in relation to children’s data privacy. 


PARENTS AND CARERS’ ATTITUDES TO DATA SHARING DEPENDED ON WHETHER THEY SAW 
THE USE OF THAT DATA AS POSITIVE OR NEGATIVE 

One key observation to come from this is that parents and carers were, on the whole, far more open to the idea of their 
child’s data being used for various reasons than might be expected. When asked whether a series of ways in which a site 
could use their child’s data should be on or off by default when their child first creates an account, many parents and carers 
said that a range of data uses should be on Figure 3. For example: 


m Between 69% and 72% (across scenarios) said “Providing info on time spent on the site” should be on by default 

m Between 49% and 61% (across scenarios) said “Tailoring adverts to their age” should be on by default 

m Between 45% and 62% (across scenarios) said “Using usage history to personalise and recommend content” should 
be on by default 
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FIGURE 3 - DEFAULT SETTINGS FOR DATA USERS 


Q14 - The following things are ways the site can use your child's information (personal data). They can all be turned on/off in the 
privacy settings. Please say whether you think each of the following things should be ON or OFF by default when your child first gets 
an account. 


á Yo an BY DEFAULT Q (AR) x + .*) 


SOCIAL MUSIC VIDEO ONLINE 
SCENARIO MEDIA STREAMING STREAMING GAME 
TOTAL SAMPLE 501 505 498 498 
Letting other site users contact your child 178% 86% 84% 77% 
Letting other sites users see when your child is 76% 84% 81% 74% 
online | 
Suggesting they join groups 75% 81% 78% 79% 
Suggesting other users they could connect with 73% 81% 79% 77% 
Letting other users see your childs posts/comments 73% 78% 82% 74% 
Offering incentives to stay on the site longer 177% 73% 76% 75% 
Using location to make recommendations | 70% 67% 75% 73% 
| | | 
Suggesting personalised or targeted adverts | 68% 67% 66% 73% 
| | 
Suggesting events they might like | 46% 48% 47% 56% 
Using usage history to personalise and recommend | 55% 38% 44% 56% 
Tailoring adverts to their age 42% 39% 41% 51% 
Suggesting personalised or targeted content 48% 25% 36% 49% 
| | 
Sending them notifications |41% 31% 32% 38% 
Personalising their experience 41% 32% 35% 29% 
Providing info on time spent on the site 28% 31% 55% 28% 
Using data to try and keep them safe online 14% 15% 17% 19% 


NB - Please note, the answer options shown in the chart are paraphrased from the survey as slightly different wording was used in each scenario. 


A NOTE ON SURVEY DESIGN: 


Many of the reasons data could be used were not framed overtly negatively; many were neutral and some were certainly 
framed in a more positive way - for example “suggesting content they might like (personalised content recommendations)”. 
It is also possible that the framing of the scenarios could impact people’s responses - the sites in question were portrayed 
as being popular, reputable and used by many millions of people including their child’s friends and family. This could allay 
some fears around mis-use of data, though largely this would depend on someone's existing perceptions regarding the 
types of service in question. 
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PERSONAL IMPACTS ARE MORE OF A CONCERN THAN ‘COMMERCIAL’ IMPACTS 


In general, parents and carers were far more concerned about protecting their child from person-to-person interaction than 
more commercial data uses. When looking at the ‘top 5’ data uses that parents and carers said should be off by default, all 
relate to encouraging greater contact with others, for example “Letting other site users contact your child” or “suggesting a 
group they could join”. This aligns with the wider theme of people tending to think of the ‘harms’ of sharing data in tangible 
terms and often coming back to more obvious potential physical or mental impact upon their child (rather than the harder- 
to-pin-down concept of certain types of adverts negatively affecting body-image, for example). 


THE FUNCTION OF A SERVICE/SITE IMPACTS PEOPLE’S ATTITUDES TO DATA USES 


What some of the differences between the scenarios used within the survey also suggests is that people are taking into 
consideration what that site/service does when they are thinking about what appropriate uses of their child’s data would 
be. The examples below suggest that when an example of data use is seen as a ‘normal’, expected, or possibly a more 
central function of the site in question, then people tend to be slightly more open to that usage being on by default. 


For example, peer-to-peer interaction seems to be considered slightly more acceptable on social media than on a music or 
video streaming service: 


m “Letting other site users contact your child” off by default is 78% on social media, and 86% on music streaming 


Suggesting personalised content is much more acceptable on music or video streaming services, indicating that people are 
taking into account the role of music streaming services in providing people with content based on their listening history, as 
services currently do; 


m “Suggesting personalised or targeted content” off by default is 48% on social media, but only 25% on music 
streaming, and 36% on a video streaming service 


Tailoring adverts to the child’s age is seen as much less acceptable on an online game than other types of sites; 


= “Tailoring adverts to their age” off by default is 51% for the online game, yet falls to 39-42% within the 
other scenarios 


The implication of this is somewhat challenging for the development of the Code as acceptability will likely vary depending 
on the exact service in question and therefore applying a single, general rule may not be meet the approval of all users. 


STRONG SUPPORT FOR SHOWING CHILDREN DEFAULT PRIVACY SETTINGS BEFORE THEY FINISH 
CREATING AN ACCOUNT 


Across each of the scenarios, just under nine in 10 parents and carers (86%) said that their child should be shown the 
default privacy settings before they finish making their account/signing up. In general, the older the child in question, the 
more likely parents and carers were to agree that they should be shown the settings before they sign up. It is likely this 
relates to how well parents and carers believe their child would be able to understand the information they are being 
shown, rather than an indication that parents of the youngest children are simply less concerned about data privacy. See 
the Language and Presentation of Terms and Conditions of Privacy Notices section for more detail. 


BEING ABLE TO SHARE LESS DATA IS IMPORTANT, BUT SO IS HAVING THE CHOICE 


The majority of parents and carers believed their child should have the option to share less data, but there was also broad 
support for giving children the choice. As can be seen in Figure 4 below, at least eight in 10 believed that their child should 
be able to change their privacy settings if they were set to low privacy (e.g. sharing more data) by default. 
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FIGURE 4 - CHANGING FROM LOW PRIVACY SETTINGS 


19. Should your child be able to change if settings are low privacy by default? 


CHANGE BY DEFAULT 


86% 


83% 


82% 


81% 


14% 


17% 


18% 


19% 


However, when asked the same question of a situation in which the site had a high privacy default (e.g. sharing less data), 


parents and carers were far less likely to say their child should be able to change their settings (Figure 5). However, almost 


half did believe their child should still have the choice. Choice was seen as more important within the context of a social 


media site, compared to others. 


FIGURE 5 - CHANGING FROM HIGH PRIVACY SETTINGS 


18. Should your child be able to change if settings are high privacy by default? 


CHANGE BY DEFAULT 


50% 


46% 


39% 


50% 


54% 


61% 


57% 


AGE OF CHILD 


2 


SOCIAL MEDIA 


MUSIC STREAMING 


VIDEO STREAMING 


8 
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The older the child, the more important personal choice about data privacy settings is considered to be. Table 1 below 
shows the percentage of parents and carers saying their child should be able to change their settings if they were set to 
high privacy by default. 


TABLE 1 


Q18. If the site had automatically high privacy settings, should your child be able to change them (e.g. to allow their data to be used more)? 


% ANSWERING YES © = D High% 
6-9 


3-5 


10-12 13-15 16-19 


35% 


24% 28% 


32% 33% 42% 


VERY STRONG AGREEMENT THAT CHILDREN SHOULD BE PROVIDED WITH INFORMATION 
BEFORE THEY CAN CHANGE THEIR SETTINGS 


Parents and carers were presented with a range of types of information that children could be shown before they are able 
to change a privacy setting, such as: 


m “What extra information sites users would be able to see” 

m “If any third parties will be able to use the data by changing the setting” 

m= “What that change will let them do on the site (that they couldn’t do before)” 

In all instances, across the scenarios, there was extremely high agreement that children should be presented with all the 


types of information. For all answer options, between 89% and 95% of parents/carers thought it was “important” their child 
was given this information. 
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PARENTS AND CARERS THOUGHT INFORMATION ABOUT DATA PRIVACY SHOULD BE 
OBVIOUS AND ACCESSIBLE 


35 


As well as asking what kind of information parents and carers thought would be important for their children to see, we asked 


about what kind of formats they thought might work best. While the specific examples we used should not necessarily 
determine what the Code recommends, they give an indication of the type of approaches that may be more effective. 


In general, people preferred specific information relevant to privacy to be shown directly when a child was changing a 
setting, rather than options that simply encouraged engagement with general privacy information: 


% OF PARENTS AND CARERS (TOTAL SAMPLE N=2,002) CHOOSING THIS AS THEIR FIRST-CHOICE OPTION. 


1. ave a pop-up box with info when they click to change a setting: 34% 


2. ave an info box next to the setting (e.g. “Read this before changing this setting”): 33% 


3. ave a pop-up box when they first go into settings reminding them to read the Privacy Notice before changing 
settings: 19% 


4. ave a reminder at the top of the page to re-read the Privacy Notice before changing settings: 13% 


Q21 - The following are some things the site could do to encourage your child to engage with the information before they make a 
change to their privacy settings. Please rank the following things, with the thing you think would work best first. 


Parents and carers also thought that a visual display of information would be the most effective way of helping their child 
understand relevant privacy information: 


% OF PARENTS AND CARERS (TOTAL SAMPLE N=2,002) CHOOSING THIS AS THEIR FIRST-CHOICE OPTION 

5. Video: 29% 

6. Cartoon: 28% 

7. Layered information (simple explanation where people can click for more info): 18% 

8. Interactive privacy information (where someone has the opportunity to ask questions, or is shown information 
based on how they respond to a question): 13% 


9. Full written information: 11% 


Q22 - There are a number of ways information about what will happen if your child changes a privacy setting can be shown. Thinking 
specifically about your child, please order the following from best to worst, based on what style of information you think your child 
would understand best? 
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RETAINING SETTINGS WAS IMPORTANT 


Retaining the changes that children make to their privacy settings was generally seen as more important than returning to 
a high privacy default between site uses. Across all scenarios, the majority felt that the settings should either be saved for 
the next time they used the site, or the child should be given the option to apply the settings permanently or just for the 
current session (Figure 6). In each scenario, however, a third of parents and carers believed the settings should be returned 
a high privacy default the next time their child used the ISS. 


FIGURE 6 - RETAINING THE CHILD’S SETTINGS 


Q23 - Once your child has finished using the site and closed the web-page or app, which of the following should happen to the settings 
they have changed? 


& They are given the 


option to apply 


© Their settings are 


@ Their settings return to 
saved for the next time 


alow privacy default 


Their settings return to 
a high privacy default 


their new settings they use the site the next time they use the next time they use 

permanently, or just for the site the site 

the current session 
30% 38% 0 30% 
24% 40% 33% 
26% 37% 34% 
22% 44% 30% 


In this question, the age of the child was important. For older children, 13+, giving them the option to choose whether their 
settings were applied permanently or just for that session was slightly more important (80% 13-17; 22% 3-15), while for 
younger children parents and carers preferred returning to a high privacy default (88% 3-9; 29% 10-17). 


This response is mirrored when they were asked about settings after a site update. In this case, 62% said settings should be 
returned to high privacy while 34% said they should remain as previously selected. Only 4% said they should default back 
to low privacy status. 
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PROMPTING ABOUT DATA PRIVACY IS ACCEPTABLE IN SOME CASES 


Parents and carers were in favour of sites prompting their child to change settings when the intention was to help the child 
increase their privacy. In total, 78% of parents and carers were happy for the site to show their child a message reminding 
them that they were sharing a certain type of data and could turn it off if they wanted (Figure 7). This compares to just 36% 
of parents and carers who were happy for the site to show their child a message suggesting they could share more. 


FIGURE 7 - PROMPTING CHILD TO CHANGE PRIVACY SETTINGS 


Q27 - When your child is using the site, a message pops up Q29 - When your child is using the site, a message pops up 
saying: Your friends can see that you're online - if you would saying: 

like to turn this function off click here”. Is it okay for the site to “Your privacy settings are stopping you seeing content you might 
prompt your child to change their settings in this way? like - change them here”. Is it okay for the site to prompt your 


child to change their settings in this way? 


YES TOTAL SAMPLE SPLIT 
1,001 PER QUESTION 


ENCOURAGING 64% ENCOURAGING 
GREATER LESS 
PRIVACY PRIVACY 


NB. question wording shown was for the social media scenario, data is total sample (n=2,002). 


A NOTE ON SURVEY DESIGN: 


The messages were tailored to the four broader scenarios - social media, music streaming, video streaming and online 
game, and the sample was split so that parents and carers were asked only one of the two questions. 


It is worth noting the ‘share more’ suggestion was framed in terms of the child currently missing out on personalised 
content that they could receive if they changed their settings, something we know parents and carers see as relatively 
acceptable compared to other data uses. We could, therefore, expect responses to this question to change depending on 
the specific prompt, although it is highly likely the pattern - prompt to share less is okay, prompt to share more is not - 
would remain the same. 


w 
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REMINDERS TO REVIEW PRIVACY SETTINGS ARE POPULAR 


When children have high privacy settings, parents and carers see less need to be reminding them to review their privacy 


KeA] 
o 


ings. Across the different scenarios, parents and carers felt sites should be reminding their child to review their privacy 


ings on a regular basis when they had low privacy, while a significant minority (25-32%) felt the sites should never be 


Wn 
o 


reminding their child to review them, providing their privacy was currently set to high (Figure 8). 


FIGURE 8 - REMINDERS TO REVIEW PRIVACY SETTINGS 


Q24/25 - If your child had high/low privacy settings (i.e. not much/a lot of their data was being used), how often, if at all, do you think 
the site should ask your child to review their privacy settings? 


& Daily @ Occasionally & Never 
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PARENTS AND CARERS OF CHILDREN WITH ADDITIONAL NEEDS FAVOURED 
HIGH PRIVACY SETTINGS BY DEFAULT 


Parents and carers of children with autism and learning disabilities often disliked the idea of their children sharing their 
personal data online. 


‘Tm not happy with anyone seeing my child’s data” 
Parent of a child with a learning disability, Buckinghamshire 


In particular, they worried about the risks of their children oversharing without necessarily understanding what they 
were doing. 


‘Tm terrified of my daughter sharing things online. 
She doesn’t understand what she’s doing” 
Parent of an autistic child, London 


As a result, some had installed software that limited their children’s online activities. Others had changed the settings on 
their children’s phone or computer to achieve the same result. 


Parents and carers of children with autism and learning disabilities also believed that decisions about online privacy needed 
to be made on behalf of their children rather than by them. 


In combination, this meant that they enthusiastically supported the idea of high privacy settings by default for their children. 


CHILDREN S 
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Transparency of paid-for content 


FEW YOUNGER CHILDREN UNDERSTOOD THAT ADVERTS COULD BE TARGETED AT THEM BASED 
ON THEIR USER HISTORY OR SEARCH DATA 


Children younger than 12 were less aware that their data could be used to give them content recommendations or to 
target them with selected advertising materials. For most younger children, it seemed difficult to think of reasons for 
websites to collect their data at all. 


Although some younger children understood that adverts could be targeted at them based on their past online activity, 
most thought that it was just by chance if an advert seemed personally relevant to them. By extension, this age-group did 


not appear to distinguish between targeted advertising and ‘random’, sponsored advertising. 


“Its just a coincidence!” 
10-12-year old, Cardiff 


Older children, over 12, did not make the same conflation between targeted and random adverts. This age-group had a 
better grasp of how the content, for example, on their social media feeds could be individually tailored to them, and that 
data about their online activity was being continuously collected. Occasionally, concerns were also raised around third- 

party sharing. 


“It’s [targeted advertising] a reminder, more than anything, that 
your data can be put anywhere... that it’s constantly being used” 


12-15-year old, Essex 


“Its ok if they ditch the information afterwards” 
10-12-year old, Cardiff 


Children over 16 had the clearest idea of how their user history and search data could be collected and could determine 
the sorts of advertising they encountered. Some also realised that their data could be amalgamated across multiple 
platforms and found this “unnerving”. 


“The way everything is linked — Facebook to 
YouTube to ASOS — it can be creepy” 
16-18-year old, Dover 
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CHILDREN SAW BOTH POSITIVES AND NEGATIVES TO TARGETED ADVERTISING 


Children of all age groups thought that adverts that were tailored to their interests could be of benefit to them, showing 
them things that they might like to buy or new online content that they might enjoy. Although 3-5-year olds did not 
recognise any disadvantage to websites using their personal information in this way, older children voiced a number of 
concerns. Some seemed sceptical of the ethics of targeted advertising, expressing their sense of discomfort or of “invaded 
privacy” related to the idea of their personal data being used to target them with selected advertising material. 


“Its creepy and weird” 


10-12-year old, Essex 


“Theyre really, really bad... unless its near Christmas” 
10-12-year old, Cardiff 


“It’s a bad thing ‘cos that’s not really what you asked for” 
16-18-year old, Swansea 


Some children also described feeling like little could be done if someone wanted to stop seeing a particular targeted advert, 
and one 13-year old was confident that ‘stop seeing this advert’ buttons were not effective. 


“If you accidentally clicked on something that you feel 
discomforted by, but then you keep getting ads about this 


thing, you just really want to get it out of your life” 
13-15-year old, Derby 


To address these concerns, several older children suggested that targeted content should be easily identifiable as such, or 
that platforms that used them should have an ‘opt-out’ function. 


“You should be told when ads are personalised” 
13-15-year old, Edinburgh 


Many children were also suspicious of adverts in general, even if they weren't targeted. For example, several were 
uncomfortable with the idea of being encouraged to spend money. 


“They just want you to waste money” 
10-12-year old, Essex 


“You might not have enough money to buy it!” 


6-9-year old, Swindon 
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“Theyre not helpful [adverts]... they just make you want to spend your money” 
16-18-year old, Swansea 


Children over 10 also frequently noted the enticing nature of some adverts, indicating some awareness of their persuasive 
intent. In general, however, children found it hard to articulate why exactly they didn’t like adverts, with several describing 
them simply as “annoying” or “distracting”. Most did nonetheless appreciate the necessity of adverts on platforms that were 
otherwise free; despite their various frustrations with adverts, overall, they seemed comfortable with this trade-off. 


“Well that’s how they make money — the internet’s 
free so they have to find some way” 
13-15-year old, Edinburgh 


CHILDREN’S VIEWS ON TARGETED ADVERTISING DEPENDED ON HOW THE TOPIC WAS FRAMED 


Interestingly, children also tended to perceive targeted advertising more positively when the researchers positioned the 
idea in opposition to ‘random’, unpersonalised advertising; when children were presented with the scenario of having to 
choose between the two, most preferred to see content that was relevant to their interests. Personal recommendations for 
further online content (such as music or videos) was also widely considered to be a good thing among older age-groups. 
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SOME ARE UNCOMFORTABLE WITH TARGETED ADVERTISING, BUT NOT ALL 


Roughly half the parents and carers in each scenario were uncomfortable with the idea of the site in question using their 
child’s personal data to target them with selected advertising material (Figure 9). Over a quarter in each scenario were, 
however, fairly or very comfortable with this, with the rest neutral. 
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FIGURE 9 - COMFORT WITH CHILD RECEIVING TARGETED ADVERTISING 


Q32 - Thinking about your [xx] year old child, how comfortable are you with their personal data being used in this way? (Target them 
with selected advertising material)? 


3 Very @ Fairly 


comfortable comfortable 


Neutral @ Fairly 


uncomfortable 


@ 


uncomfortable 


Attitudes towards targeted advertising among those in the music streaming service scenario were slightly more open 
regarding targeted advertising, possibly due to the function of the site. 


WHEN ADVERTS ARE GUARANTEED, TARGETED MARGINALLY TRUMPS ‘RANDOM’ 


In the context of sites requiring advertising revenue to remain free to use, parents and carers preferred that their child 
received targeted rather than “random” advertising - 55% vs. 45%, (Figure 10). It is worth noting that the language of the 
question answers could play a part in the outcome - “random” could be perceived negatively, and earlier in the survey we 


have discussed the idea that targeting could mean providing age appropriate adverts, which is largely seen as positive. 
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FIGURE 10 - TARGETED OR RANDOM ADVERTS 


Q34 - As the site is dependent on paid advertising to let people 
use the site for free, if your child uses the site they will always see 
some advertising. Thinking about your [xx] year old child, which 
of the following would you be most comfortable with? 


TOTAL SAMPLE 45% 


2,002 


O For my child to see targeted adverts based on 
information the site holds about them 


o For my child to see random adverts only, not 
using information about them to target them 


ENSURING ADVERTS ARE COMPLIANT WITH INDUSTRY STANDARDS IS ENOUGH 
FOR MANY PARENTS AND CARERS 


Parents and carers were provided with a range of options in relation to what sites should do to help children understand 
when they are seeing an advert, sponsored content or product placement. The most popular option across the scenarios 
was simply to ensure the content their child was seeing met industry guidelines for advertising directed at children, 
ensuring that, regardless of the type of content or reason for seeing it, it is at least appropriate (Figure 11). 
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FIGURE 11 - HOW TO MAKE ADVERTS AND PAID-FOR CONTENT TRANSPARENT 


Q36 - The site is deciding what it should do about “sponsored content” and “product placement”. Thinking about your [xx] year old 
child using the site, which of the following do you think the site should do when it uses your child’s personal data to target them with 


this type of content? (Select top 2) 


TOTAL SAMPLE 
(2,002 - % AVERAGED ACROSS THE FOUR SCENARIOS) 


. Make sure the content meets industry guidelines for advertising 
directed at children 


. Add a label saying what the content is (e.g. “this is sponsored 
content” or “this contains product placement” or “this is an advert”) 


. Addalabel explaining why the content has been selected for your 
child to view 


. Blur or blank out the content so it is only viewable once someone 
clicks on it 


. Adda “find out more” button which will tell them whether it’s an 
advert and why they are seeing it 


. Nothing 


50% 


35% 


30% 


20% 


12% 
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PARENTS AND CARERS OF CHILDREN WITH DISABILITIES FELT THAT THEIR CHILDREN WERE MORE 
VULNERABLE TO BEING “EXPLOITED” BY TARGETED ADVERTISING 


RESEARCH Parents and carers felt that children with disabilities could be more easily taken-in by advertising, partly because these 
children may be more vulnerable to peer pressure to have the newest things. Parents also felt that children with disabilities 


ADULTS 
QUALITATIVE 


were less able to recognise adverts that had been tailored to their interests. 


“They [targeted ads] exploit the natural weaknesses of children” 
Parent of disabled child, London 


“Children with disabilities can be more vulnerable to 
external things being part of their identity” 
Parents of disabled child, London 


In the context of sites requiring advertising revenue to remain free to use, parents and carers of children with additional 
needs still preferred that their children should not be shown targeted adverts. 
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Strategies used to encourage extended user engagement 


CHILDREN WERE CONCERNED ABOUT THE HEALTH RISKS THAT COULD BE 
CAUSED BY TOO MUCH SCREEN-TIME 


Amongst children over the age of 6, there was a discernible tension between whether encouraging prolonged engagement 
was a good thing that aided progress in games, or whether it resulted in too much screen time and a loss of control. 


Despite several children seeking out the in-game rewards available for extended engagement, most children of all ages 
were worried that spending too much online could have detrimental consequences for their health or wellbeing. This was 


expressed both in terms of their social capacity and their physical health. 


Concerns about the risk of ‘addiction’ were raised in all groups, and Fortnite was frequently cited as a game that is 


particularly conducive to people becoming obsessive and antisocial. Other children also worried that prolonged screen- 


time would stop them doing other activities they wanted to do, and might mean that they missed out on things. Some of 


the younger children also seemed concerned with the effect that too much screen-time could have on eye-sight. 


“They [features promoting extended play] get you more addicted to the game” 
10-12-year old, Derby 


OLDER CHILDREN WERE MORE CONFIDENT IN THEIR ABILITY TO MAINTAIN CONTROL WHEN THEY 
ENCOUNTERED EXTENDED ENGAGEMENT STRATEGIES 


Those older than 16 also perceived both advantages and disadvantages to features that promote extended play. In general, 
however, they placed more emphasis with the player’s agency and ability to judge when to stop playing, indicating that loss 
of control was less of a concern than it was amongst younger children. 


A NOTE ON RESEARCH DESIGN: 


The scenarios used to explain this topic children were based on a game using a child’s personal data to provide them 

with a reward that encouraged them to play the game for a longer amount of time. However, it is hard for children to 
distinguish between design features that are built into the app to encourage extended use, and design features that are 
specifically using personal data in order to encourage extended use. Therefore, we cannot be certain that children made 
this distinction when speaking about this topic. However, given that the outcome, prolonged use, is the same, we can infer 


that their attitudes towards both situations would be the same. 
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THE MAJORITY THINK ‘DWELL INCENTIVES’ OUGHT TO BE OFF 


Around three quarters (73-77%) of parents and carers across the scenarios felt that “Offering them incentives to stay on 
the site longer” should be off by default. Responses were consistent across the different scenarios, and largely by the age 


of the child, although parents and carers of 3-5-year olds were more concerned about this, with 85% saying this function 
should be off, compared to 72-76% in all other age groups. 


PARENTS AND CARERS FELT THAT NEURODIVERGENT CHILDREN MAY BE MORE SUSCEPTIBLE 
TO FEATURES PROMOTING EXTENDED ENGAGEMENT 


Parents and carers of neurodivergent children, particularly those with autism, thought that they could be more prone to 
getting addicted to online games. This was because they felt that games could provide their children with the positive 
feedback and gratification that they sometimes lacked elsewhere in their lives. 


Parents and carers of neurodivergent children also expressed dislike of ‘pay-to-win’ games, in which players are able to pay 
for content or specific items that would give the player a significant advantage in the game. Several parents had experience 
of their children making in-app purchases that they had not authorised, and some suggested that these apps should not be 
free at the point sign-up, encouraging parental involvement from the start. 
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Data minimisation standards 


MANY CHILDREN FELT UNCOMFORTABLE SHARING PERSONAL DATA WHEN THEY COULDN’T 
UNDERSTAND WHY THE PLATFORM WAS ASKING FOR IT 

With a few exceptions, children of all ages shared the same attitude: people/organisations should only be able to access 
their personal data when it provided a clear benefit to them (the child), and they could understand why the platform 
needed that bit of information. 


For example, children could explain that when Amazon asks for their home address it is clear this needed is for delivery 
purposes but were unable to understand why an online game would need their email address. 


Many children felt uncomfortable sharing personal data when they didn’t understand why it was needed, and all age 
groups felt that platforms were often too ‘nosy’ and asked for information that they did not think was necessary. This was 


especially the case with children aged 10+ who were on social media, as they often felt that it encouraged them to share 


more information than they were comfortable with. 


“I should only need to provide data that the app actually 
needs — it is nosy and rude of them to ask for more” 
6-9-year old, London 


“Social media encourages you to share more 


information than you would do normally” 
10-12-year old, London 


DEFINITIONS OF WHAT CLASSIFIED AS ‘NECESSARY’ DATA FOR A PLATFORM TO ASK FOR CHANGED AS 
CHILDREN GOT OLDER 


When children were shown examples of different types of data (e.g. age, toys | like, where | live) and the people who may be 
able to see it (e.g. parents, teacher, doctor, people who work at YouTube), those as young as four years old decided whether 
it was ‘okay’ to give or not by thinking about the logical reasons why it would be beneficial for that person/organisation to 
know the information about them. 


For example, children noted that a doctor may need to know your address in case they have to visit you at home, and 
YouTube will need to know your age to ensure you don't see content that is inappropriate for your age. 


Younger children tended to see the benefits of data sharing in narrow terms, focusing on how it could: 


m Protect them (e.g. so that the child only sees age appropriate content) 


m Provide them with a direct, and tangible, benefit (e.g. to give the child a new game to play) 


Older children, by contrast, had a broader understanding of the benefits of data sharing, and understood that it may be 
required in order to: 


m Make money so that the platform can run 


m Confirm their identity so they can make an account 


m Do market research to develop new platforms 


CONCERNS THAT A PLATFORM IS ASKING FOR ‘UNNECESSARY’ DATA RARELY PUT CHILDREN OFF USING THEM 


Most of the time the uncomfortable feeling of being asked for ‘unnecessary’ information, and the fear that different bits of 


data could be used together to identify them, did not stop children from using the platforms they wanted to use. However, 
some had used strategies, such as making up fake information, as way to avoid giving out data they didn’t want to. 
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“Name is okay, but I would always make up my address and school” 
10-12-year old, Derby 


OLDER CHILDREN SAW THE RISKS OF DATA BEING COMBINED 


Very young children, under 6, were less able to understand risks of jigsaw identification (i.e. lots of seemingly small pieces 
of data being used in combination to identify you). They felt that if you couldn't be identified by one piece of info (e.g. your 
gender) it was fine to tell someone - they made this decision separately every time, rather than thinking about all the data 
as a whole. 


However, as children got older, they became aware that the more information they gave to a platform, the more identifiable 
they became, as their data could be layered together to build up a clearer picture of them. For example, whilst some were 
happy to share their age and the area where they live separately, they worried that when you gave someone these bits of 
information combined it would make it easier for someone to use the data in way that could lead to negative outcomes. For 
most children, these negative outcomes involved a fear of being physically tracked down or hacked. 


“I wouldn't mind if they [the game] knew what dog I have because 
other people might have that dog too, but if they also knew the 
area I live in they could see my dog and follow me to my house” 
6-9-year old, Luton 


CHILDREN WERE LESS FAMILIAR WITH THE INDIRECT WAYS THAT DATA COULD BE COLLECTED, 

AND WANTED PLATFORMS TO BE MORE EXPLICIT ABOUT THIS 

Children of all ages believed that they had a high degree of control over the data they shared online, discussing tactics they 
used to limit what they shared (for example, using fake names or dates of birth). Throughout the groups, however, children 
demonstrated their lack of awareness of the indirect ways in which organisations/companies collect data on their activities 


online (e.g. cookies, browsing histories). 


When the indirect ways of data sharing were spoken about, children often felt uncomfortable, as they did not feel like they 
were in control of what platforms could see and didn’t feel like they had consented to sharing this data. 


“They [the platform] can access information you're not aware they can see” 


16-18-year old, Swansea 


“Some apps can track where you have been...it’s a bad 
thing cos that’s not really what you asked for” 


16-18-year old, Swansea 


Many of the younger children had been taught about permission to use someone else's data in the context of taking and 
uploading photos of others and needing to ask for their permission to do this. Children therefore felt that they should 
have to give explicit permission for their data to be used and thought that sites should be clearer about the data they are 
collecting and why, giving them a chance to decide whether or not to allow it. 
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ATTITUDES TO DATA MINIMISATION ARE QUITE CLEAR: ONLY NECESSARY DATA SHOULD BE COLLECTED 


Parents and carers were asked to choose between three options regarding the collection of data from children: 


m 75% - sites should only ever collect the data that’s needed for their service to function 
m 17% - the data collected is used to improve my child’s experience using the website/app so I’m happy for it to 
be collected 


m 8% - if my child has chosen to use a website/app then | don’t mind what data they collect 


Of course, what this does not address is what exactly ‘necessary’ data actually would be when it comes to the functions 
of an ISS. 


PARENTS OF CHILDREN WITH LEARNING DIFFICULTIES FELT THEIR CHILDREN WERE PARTICULARLY 
VULNERABLE TO THE CONSEQUENCES OF SHARING PERSONAL DATA ONLINE, AND SOME FELT IT WAS 
INAPPROPRIATE TO ASK THEIR CHILDREN FOR THIS INFORMATION 


Some parents who had children with learning difficulties felt that their children should not have to share any personal data 
in order to do the things they wanted to do online, such as watch YouTube videos. This stemmed from the fact that many 
parents thought that their children were vulnerable to people inappropriately using their data as parents felt they were 
overly trusting of others and naive about how their data could be used. 


Parents were also worried about the consequences of their child sharing personal data online, particularly that their child 
could either become vulnerable to grooming or that their data may be shared inappropriately. 


Similarly, parents felt it was wrong to ‘make’ children accept cookies in order to use a site, and to sell this data to other 
companies, as they did not think their children were in a position to consent to this. 


“Its like you're being held to ransom by sites because they know you 


have to agree to cookies in order to continue using the site” 
Parent of child with learning difficulties, Buckinghamshire 


“It’s [cookies] exploitative, as children don’t really understand” 
Parent of disabled child, London 


PARENTS WORRIED THAT THEIR CHILDREN WOULDN'T BE ABLE TO UNDERSTAND THAT PLATFORMS CAN 
TO BUILD UP A PROFILE OF YOU THROUGH COMBINING BITS OF DATA 


Parents of those with autism in particular were concerned that information could be deduced about their child without 
them explicitly giving it e.g. platforms working out their age group, preferences and interests without their child actively 
providing them with this information. Some worried that their child wouldn't understand this and acknowledge this risk. 


“My child has no idea data can be added together to identify you” 
Parent of child with autism, London 
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The language and presentation of terms and conditions 
and privacy notices 


EApeEniG THERE WAS A TENSION BETWEEN CHILDREN WANTING TO KNOW MORE ABOUT HOW THEIR DATA IS 
QUALITATIVE BEING USED AND NEVER READING THE T&CS OR PRIVACY NOTICES 


RESEARCH Although most children felt that you should read terms and conditions before going on a site for your own safety, and 


many said they wanted to learn more about how their data would be used by platforms, most admitted that they never 


CHILDREN S read T&Cs. 


een In many cases, the desire to use the platform outweighed concerns they might have about data privacy. 


“If you like the game enough you will probably just 
accept them [terms and conditions ]” 


10-12-year old, Essex 


“Too much of it is irrelevant, you just skip and click accept” 
16-18-year old, Edinburgh 


As expected, the main reason children gave for not reading T&Cs was the perceived complexity of the language used, and 
the length. Children were quick to suggest ways that T&Cs could be improved, including paraphrasing statements; bullet 
points; colour; pictures; keeping it short and simple, and; providing T&Cs which are tailored to the age of the user. Some 


also felt that there should be more flexibility to agree to some parts of the terms and conditions and disagree to others, as it 
was felt that currently it is ‘all or nothing’. 


“Don't use fancy words like disclose” 


13-15-year old, Essex 


“There should be a paraphrase button” 


13-15-year old, Derby 


“Companies should have to make their terms and conditions understandable 
to children...they should limit the amount of stuff they have to write” 
10-12-year old, Essex 


However, some older children recognised that it might be hard for platforms to tailor T&Cs to children of certain ages, 
when many are using fake ages in order to protect their privacy, or to get around age restrictions needed to access sites. 


Therefore, older children acknowledged that it would be hard for platforms to accurately identify who children are, making it 
difficult to provide child friendly terms and conditions. 


Some of the younger children felt that it should not be totally their responsibility to process the terms and conditions, and 
that it should also be down to their parents to ensure the child is aware of what they contain. 
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“T think it is like a shared responsibility” 
10-12-year old, Cardiff 


SOME OF THE OLDER CHILDREN FELT THAT TERMS AND CONDITIONS WERE INTENTIONALLY 
INACCESSIBLE, SO THAT PLATFORMS COULD ‘TRICK’ THEM AND ‘COVER THEIR BACKS’ 


Some children thought that the language used in terms and conditions was deliberately complex, so that children would not 
be able to understand it, and therefore companies could include things that children may not agree with. 


“They [T&Cs] are used to get you to agree to 
things you wouldn’t normally agree to” 


13-15-year old, Edinburgh 


“They use lots of law speak to confuse you on purpose” 


13-15-year old, Essex 


“Things are snuck in there without you knowing” 


13-15-year old, Derby 


“They purposefully make the terms and conditions like that, 
like they stretch it out so it should only be three pages they 
stretch it to 7—9 pages, and they make it so small” 
10-12-year old, 


Many thought that terms and conditions were only there for the company’s benefit and not for the user - to legally protect 
the company against being sued rather than to educate the user about how their data would be used. 


“Theyre there so that people can't sue them [the platform]” 
13-15-year old, Essex 


A NOTE ON RESEARCH DESIGN: 


As most children were not able to differentiate between ‘terms and conditions’ and ‘privacy notices, and were more familiar 
with the concept of ‘terms and conditions’ the research focused primarily on T&Cs. However, we can infer that their views 
on the language and presentation of T&Cs can also be applied to privacy notices. 
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ONLY A MINORITY OF PARENTS AND CARERS THOUGHT THEIR CHILD WOULD NOT ENGAGE 


Rie WITH THE PRIVACY NOTICES OR T&CS 
RESEARCH Four in 10 parents and carers (40%) think children would ask them to read privacy notices and T&Cs, while between a fifth 
and quarter across the scenarios believed their child would read the privacy notices and T&Cs “thoroughly” themselves 
(Figure 12). 


FIGURE 12 - CHILD READING PRIVACY NOTICES 


Q10 - Which of the following would you expect your child to do if asked to read the privacy notice and site's T&Cs? 


© Read the Privacy Scan through the © Ask you to read them r Click ‘accept’ without 
Notice and T&Cs Privacy Notice and with them really reading the 
thoroughly before T&Cs to read one Privacy Notice 
clicking ‘accept’ or more particular and T&Cs 


sections before 


SCENARIO TOTAL s iaai 
clicking ‘accept’ 


SAMPLE 


2 m 
SOCIAL MEDIA 501 
Q : 
MUSIC STREAMING 505 
- m 
VIDEO STREAMING 498 
® e 
ONLINE GAME 498 
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We know from the direct research with children that the incidence of truly engaging with privacy notices and T&Cs is likely 
to be quite low, suggesting that the parents and carers may be somewhat optimistic when it comes to what they think their 
child would actually do. 


Among those who didn't think their child would read the privacy notice and T&Cs thoroughly, the reasons they provided 
for their child’s assumed lack of engagement chimed with what we found in the direct research - a general desire to use the 


service in question trumping concerns over data privacy. 


Ordered by the average across scenarios, the reasons were: 


They aren't interested (53%) 
They think there is no point - if they want to join they will have to click accept anyway (49%) 
t would delay them from starting to use the site/app (39%) 


They think they wouldn't understand anyway (34%) 


+ 


They trust the service provider (19%) 


They think it’s not meant for them (15%) 


Think their parent/carer should read them (11%) 


poe Nau PWN PE 


Too young to read (3%) 


SCENARIO TOTAL 


SAMPLE 


® 


SOCIAL MEDIA 501 


@ 


MUSIC STREAMING 505 


VIDEO STREAMING 498 


ONLINE GAME 498 
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MANY WOULD NOT BE ABLE TO UNDERSTAND PRIVACY NOTICES AND T&CS 


Less than a fifth (20%) of parents and carers thought their child would be able to fully understand how their data was being 
used by reading privacy notices and T&Cs (Figure 13). 


FIGURE 13 - CHILD UNDERSTANDING OF PRIVACY NOTICES 


Q12 - How much do you think your child would understand how their data will be used from the privacy notice and T&Cs when signing up 
for this site? 


@ They would 


understand fully 


They would 
understand a little bit 


They probably 
wouldn't understand... 


© They wouldn’t 


understand at all 


Perhaps unsurprisingly, the older the child, the greater the assumption that they would be able to understand from privacy 
notices and T&Cs how their data was being used. It is worth noting, however, that even among parents and carers of 
16-17-year olds, 29% thought their child would “probably not understand” or “not understand at all”. 


As highlighted in the earlier Themes section, providing additional information does not necessarily mean children will 
engage with it effectively. The relatively low numbers of parents and carers who think their child would be able to decipher 
how their data was being used from current T&Cs reaffirms this - particularly when parents and carers are potentially 
overestimating how much their child would really engage with this kind of information in the first place (see Q10 above). 


PARENTS AND CARERS REFLECTED CHILDREN’S VIEWS THAT TERMS AND CONDITIONS ARE 
INACCESSIBLE, PARTICULARLY FOR CHILDREN WHO HAVE LEARNING DIFFICULTIES 


Some parents felt that their children should not be using a platform if they are unable to understand the terms and 
conditions, and all parents agreed that their children would not be able to understand the majority of terms and conditions. 


Others were sceptical of whether companies even abided by the terms and conditions they had set out. 


“Nobody knows what they are, and they’re never enforced either” 
Parents of child with learning difficulties 
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Right to erasure, rectification and restriction 


CHILDREN OF ALL AGES THOUGHT THEY SHOULD HAVE THE RIGHT TO ERASE OR RESTRICT THEIR ONLINE DATA 


Children of all ages thought that they should have the right to erase data about themselves. Their primary concerns related 
to data being shared online that could put them in physical danger or embarrass them. For example, people being able 

to find their address and then track them down with improper intentions, or images that the child was unhappy with as it 
made them look silly or provoked other negative feelings. 


OLDER CHILDREN TENDED TO BELIEVE IT WAS IMPOSSIBLE TO ACHIEVE TRUE ERASURE 


There was an overriding sense from children, particularly those in the older groups (10+), that once something was on the 
internet, particularly social media, it was very hard to remove it. Some felt that as soon as you post something online your 
‘control’ over that bit of data is lost. 


Children were also aware that even though you might think you have deleted something, it could still be accessed, because 
other people may have screenshotted it for their own use, or it might still be stored on a platform's server. 


“You can't ask to take it back because it’s already out there” 


16-18-year old, Swansea 


“There’s not much you can really do [if you want to remove something ]” 


16-18-year old, Swansea 


“The internet never forgets” 


16-18-year old, Dover 


“It [deleted photo] will always be on a platform’s 
server, like as aremembrance of you” 
10-12-year old, Derby 


Older children thought that they should be able to find out what information was being kept about them so that they could 
decide what should be erased and what should be kept. 


YOUNGER CHILDREN TENDED TO THINK DATA ERASURE WAS MORE ACHIEVABLE, BUT HAD 
MISUNDERSTANDINGS ABOUT HOW TO REMOVE PERSONAL DATA 


Younger children tended to feel it was more achievable to erase, alter or restrict personal data, provided they asked a 
trusted adult to help them. 


“You can just tell your mum that you want to delete it” 
3-5-year old, Luton 


Younger children also had more simplistic views about what constituted ‘data erasure’ - believing that if they could no 
longer ‘see’ their data, it no longer existed. For example, some believed that by deleting an app they would also delete all 
of the personal data that was on it. One child had deleted a game he was playing and then redownloaded the app a few 
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months later, to realise that all of his personal data and account was still on the game. He described this as ‘creepy and 
weird’ as he was surprised that the data had not been deleted when he deleted the app. 


ONLY SOME CHILDREN ARE EXPECTED TO BE ABLE TO IDENTIFY AND ACTIVATE DATA RIGHTS 
THEMSELVES 


Between three and four in 10 (32-43%) parents and carers believed their child would be able to ‘use’ various data rights. 


The rights themselves are not asked about in the context of exactly how a child might go about retrieving information from 


a site or having their personal data deleted, for example. As such, the question is best seen as providing an indication of 
how many parents and carers feel their child could engage effectively with issues of rectification, erasure and restriction 
more generally. Importantly, without understanding how aware children themselves are with these rights, it is very hard for 
a parent to say whether they really would be able - or willing - to use them. 


ost parents and carers (68%) did not think their child would be able to find out about their rights if the site they were 


using did not specifically inform them of them. As expected, the younger the child, the less likely their parent or carer would 


hink they could find out about their rights. 


ENSURING INDIVIDUAL SITES ACTIVELY ENABLE CHILDREN TO ACTIVATE THEIR RIGHTS IS SEEN 

AS MARGINALLY THE MOST IMPORTANT 

Parents and carers were presented with a range of things that sites could ensure happen to assist children who want 

o activate their rights, for example, having data deleted or objecting to direct marketing. The responses indicated that 
preferences were extremely split, with none of the seven solutions attracting more than an average point-attribution of 2.1 
out of 10. 


arginally the most important thing a site could do was to provide clear instructions on what the child needed to do (2.1). 


This was followed by enabling children to do these things themselves (1.5) and having a range of support (1.4). 
Here is the full list - ranked most to least important: 


1. The site providing clear instruction on what they need to do (2.1 average points attributed out of a possible 10 - 
more points = more important) 


Being able to go through the process by themselves (e.g. clicking through an automated process step by step) (1.5) 
The site having online and offline support to help guide them through the process (1.4) 


Ensuring the process is the same on every site, app, game they use (1.4) 


vp oN 


Being able to go through the process themselves, but ensuring a person working for the site checks whether 
they need any assistance (1.3) 


6. Having an independent body contact the site on their behalf (1.2) 


7. Ensuring the site processes their request within a time limit (1.1) 


PARENTS AND CARERS OF CHILDREN WHO HAD LEARNING OR DEVELOPMENTAL DIFFICULTIES WORRIED 
ABOUT THEIR CHILD’S ONLINE FOOTPRINT 


Parents worried about their children oversharing their personal data and making mistakes online more often than other 
children. This meant they were keen to ensure that there was some way to rectify their children’s actions, as they felt that it 
was important that the internet allowed them to make mistakes and that their data could be permanently removed. 
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User reporting and resolution processes and systems 


CHILDREN DID NOT THINK THAT REPORTING PROBLEMS TO A PLATFORM OR ORGANISATION 
WAS LIKELY TO BE EFFECTIVE 


ost children felt that there were limited actions that they could take to report things that they didn't like online. Some 
older children expressed concern that social media sites would not take requests seriously and even though they were 
ypically aware of the report button, few were confident that social media sites would resolve their issue if they reported a 
problem. Some felt that certain sites, such as Facebook, even discouraged you from reporting by suggesting other means, 
such as blocking the person. 


This resulted in many feeling a lack of trust towards platforms and their capacity to remove data. 


“Report buttons are just for show” 
13-15-year old, London 


“Nothing will ever happen with reporting, it’s pretty lenient” 
16-18-year old, Edinburgh 


Similarly, some children felt they should be able to speak to the platform if they were unhappy with their terms and conditions 
but saw this as inefficient as it would take too long to get through to them. In this way, platforms were seen as difficult to 
communicate with, and so as a result most favoured taking direct actions themselves than trying to speak to the platform. 


For example, most thought that direct actions such as blocking people and deleting content, would be more effective than 


going through the platform’s reporting process. 


YOUNGER CHILDREN WERE MORE LIKELY TO SEEK HELP FROM TRUSTED ADULTS IF THERE WAS AN ISSUE 


Most younger children, under the age of 10, did not think about alerting the platform if there was an issue, and would 


instead tell a teacher, parent, or in some cases, their school’s IT department, in the hope that they would be able to sort the 
problem out. 


“You should always tell a teacher or your mum” 
3-5-year old, Luton 


A NOTE ON RESEARCH DESIGN: 


It is important to note that most of the conversation about reporting tended to revolve around how to remove unwanted 
photos or nasty comments being posted online. Although some older children were aware that they could also report or 
hide adverts on social media, most children were not aware of many other things that may warrant reporting. 
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THERE WAS A CLEAR HIERARCHY IN PARENTS’ AND CARERS’ PRIORITIES WHEN IT CAME 
TO RESOLVING DIFFERENT SORTS OF ONLINE ISSUES 


ADULTS 
QUANTITATIVE 


RESEARCH As has been highlighted previously, when asked to consider the negative aspects of online data use and data sharing, 
more tangible, personal issues (e.g. cyber-bullying) seemed to be more salient, and to pose a more immediate threat, than 
seemingly less concrete commercial issues such as selling personal data to advertisers. 


This pattern can be seen in how parents and carers prioritised a series of potential online issues to be resolved by a website 
in a hypothetical situation (Figure 14). Naked images, cyber-bullying and aggressive or threatening content were all seen 

as priority issues, while things such as misuse of geolocation, inappropriate adverts or selling personal information to 
advertisers were considered low priority in comparison. Just 10% felt that issues should have no priority order and be dealt 
with in the order they are received. 


This provides a useful context in analysing the overall research findings, where concerns about interpersonal uses of data 


are better understood and tend to cause more concern. Therefore, when asking parents and carers about commercial uses 
of data it is important to remember that these are seen as relative to interpersonal uses, which may mean they seem less 
threatening in comparison. 


FIGURE 14 - PRIORITISING ONLINE ISSUES 


Q40 - Imagine that you are responsible for deciding the order in which a series of issues are dealt with by a website/app. Please put 
the following issues/complaints your site has received in the order you would deal with them. 


TOTAL SAMPLE 
2,002 


Naked images/ a 
“revenge porn” 54% 


Cyber-bullying 319 
‘oO 


Aggressive/threatening 


19, 
content 30% 


Using location data to track £ 
someone without permission -18% 


Being targeted with y 
inappropriate adverts -42% 


Selling personal 
information to 
advertisers 


-55% 


%s shown are those ranking issue 1st or 2nd minus those ranking 5th or 6th 
No priority - deal in order received - 10% 
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ONLY THE OLDEST CHILDREN WERE EXPECTED TO BE ABLE TO MAKE A COMPLAINT BY THEMSELVES 


Six of every 10 parents and carers (60%) believed they would have to make a complaint or report a problem to a site on 
behalf of their child. As with other questions around a child’s capability to do something themselves, the older the child, the 
greater belief they would be able to make a report to a site by themselves. It is worth noting that even among the parents 
and carers of 16-17-year olds, almost a third (29%) felt they would need to report or complain to a site on their behalf. 
One potential factor in responses here is whether the parents and carers are considering simply the practical process of 
reporting an issue, or whether they are also taking into account whether they think their child would notice or consider an 
issue worth reporting. 


Parents and carers were also asked about a series of practical applications that sites could employ to assist children to report 
issues. None of the below possibilities was considered to be much more preferable than any others, suggesting either that 


the options all had their own merit, or potentially that people simply struggled to imagine each of the options in practice. 
Average score out of 10 (point attribution question where more points = more preferred), descending order: 


1.9 A large “help” icon on the home screen of all sites to provide information about making a complaint or having content 
removed 


1.7 A tool people could use to delete content themselves 
1.6 A helpline number to talk to someone who can remove content/help with a complaint 
1.4 A web-form on sites people can use to complain or request content to be removed 


1.3 A link to complain directly to the Information Commissioner's Office 


1.1 A rule that ensures “help” information can be found in the same place on all websites 


1.0 Links to child advocacy services who could provide support 


PARENTS OF DISABLED CHILDREN MAY BE MORE LIKELY TO MAKE A COMPLAINT ON THEIR CHILD’S 
BEHALF 


Many parents and carers of disabled children spoke about having access to their children’s accounts on social media, so 
they are able to monitor what they are sharing and seeing. This meant that they may have been more likely to see things 
and make a complaint on their child’s behalf. 


“I can keep an eye on what theyre doing” 
Parent of disabled child, London 
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Advice from independent, specialist advocates on all data rights 


CHILDREN OF ALL AGES WANTED THEIR COMPLAINTS TO BE TAKEN SERIOUSLY, 
BUT WEREN'T SURE WHO TO TURN TO 


Whilst we did not explicitly ask children if they were aware of any specialist data rights advocates, they were not mentioned 
by any of the children when discussing how to deal with personal data issues. Instead, younger children tended to turn to 
trusted adults for help, whilst older children would take action themselves or attempt to contact the platform. 


However, given that many were frustrated when they felt their complaints were not being taken seriously, we can infer 
that they may have benefited from an advocate's advice and involvement. In addition to feeling like their complaints were 
ignored, other problems that children faced were being able to understand terms and conditions, being able to easily 
review the personal data that a platform holds about them and being able to fully remove their data. 


Some younger children had assumed that platforms popular with children, such as YouTube, were being regulated in some 
way and could be trusted. These children felt more confident that these platforms would be able to protect their data rights. 


“(YouTube is] licenced to work with kids” 
6-9-year old, Luton 


SOME PARENTS WERE AWARE THAT THE GDPR WAS THERE TO PROTECT PEOPLE’S PERSONAL DATA 


Some parents had heard of the GDPR and knew its purpose was to protect people’s data but were unaware of the specifics 
of this. Again, whilst their knowledge of specialist advocates for data rights was not explicitly asked, no parents mentioned 
them when discussing protecting their children’s data. 
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Annex 1 


Context from the adults’ quantitative research data 


Within the parents’ and carers’ survey responses there are a number of trends and additional context that sheds further 
light on the results. The following are more general, overarching points or survey answers that do not directly relate to the 
11 areas of the code discussed above: 


TRANSPARENCY OF DATA REQUIREMENTS SHOULD BE COMPULSORY 


95% say that sites should make it clear what personal data they will require to work BEFORE the child begins the 
sign-up process. 


THE OLDER THE CHILD, THE MORE CAPABLE, INDEPENDENT OR AWARE THEY ARE GENERALLY ASSUMED TO BE 


We highlighted earlier on that age does not make as large a difference as might be expected when it comes to issues of 
data privacy and protection - i.e. it is not as simple as the youngest should be completely protected, and the oldest treated 
more like adults - and this is certainly still the case when analysing the survey data. However, when asking about a child’s 
ability to understand, or do something, parents and carers of older children were more likely to report that their child would 
be capable, as you would expect. 


PREFERENCES FOR THINGS SITES COULD DO SHOULD BE SEEN AS INDICATORS OF OPINION RATHER 
THAN SUPPORT FOR SPECIFIC APPROACHES 


Throughout the survey we asked a number of questions to gauge preferences for specific types of action a site could take 
in relation to data privacy. For example, the kinds of messages that could be shown when changing privacy settings; ways 
of highlighting that content is advertising or paid-for content; on-site solutions when reporting issues etc. 


It is important to note that despite including examples where possible, it is both difficult for people to imagine the options 
in context, and to truly know how useful/effective something might be for someone else (i.e. their child). These questions 
do, however, provide indications of the types of qualities that could be useful in a real-world application. 


FATHERS AND MALE CARERS ARE MORE ACCEPTING OF DATA SHARING THAN MOTHERS AND FEMALE CARERS 


Throughout the survey there is a general trend of male respondents being slightly more ‘laissez faire’ in their attitudes 
towards the collection and use of their child’s data. For example, male respondents were less likely to say: “sites should only 
ever collect the data that’s needed for their service to function” (70%) compared to female respondents (80%). Similarly, 
female respondents were more likely to see ensuring their child's data was used appropriately as their responsibility (80%) 
than men (71%). 


BACKGROUND CONTEXT FOR THE PARENT AND CARERS 


There are a number of additional factors about the parents and carers that are useful in understanding and interpreting their 
responses to some of the more specific scenarios and data privacy questions. Firstly, parents and carers see themselves as 
having primary responsibility for ensuring their child’s personal data is only used in ways that are appropriate to their age 
(43% - see Figure 15), slightly ahead of providers of online services (39%), and noticeably more so than the ICO (9%) and 
the government (5%), and their child (5%). 


What this indicates, therefore, is that people do not see themselves as devoid of responsibility by defaulting to making 
everything the responsibility of the sites their children are using. Understanding this helps to explain why, in some cases, 
parents and carers were perhaps more open to data uses than might have been expected, and links to the wider theme of 
wanting to use online services. 
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FIGURE 15 - RESPONSIBILITY FOR ENSURING APPROPRIATE CHILD DATA USE 


Q47 - Who do you think has a responsibility to ensure that information about your child is only used in ways that are appropriate to 
their age? (Tick all that apply) 


Q47A - Who has primary responsibility? (Tick one) 


TOTAL SAMPLE Primary Who should be primary 
2,002 responsibility responsibility 


Myself as their parent/carer 43% 76% 


Providers of the online services 


they use 39% 65% 


The information 

commissioner’s office (the 9% 43% 
uk regulator for the use of 

personal data) 


The government 5% 36% 


My child 5% 31% 


Many parents and carers also reported that they had talked with their children to some extent about data privacy, 
particularly as children got older (Figure 16). 
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FIGURE 16 - TALKING TO CHILD ABOUT DATA PRIVACY 


Q49 - Which of the following best describes how much you talk to your child about online privacy? 


@ We have talked 8 We have & We have @ We haven't B We're planning & We don't 


about it alot talked about talked about really talked to talk about it need to talk 
ita few times it alittle bit about it with them when about it 
they're older 


AGE OF CHILD 
TOTAL SAMPLE 


3-5 12% 20% 10% 34% 11% 
144 


6-9 20% 35% 9% Th 5% 
465 


10-12 29% 39% 6% 
507 


13-15 29% 45% 6% 
522 


16-17 25% 43% 7% 
364 


Overall, 66% of parents and carers have changed their own privacy settings to make them more private (while only 9% 
have opened them up). This compares to 14% who have never changed their settings and 12% who aren't on social media. 


More than three quarters of parents and carers (76%) have limited their children’s internet access in some way. The most 
popular route is through clear rules around online time (52%) while smaller proportions also block access in some way - 
either via the WIFI (22%) or on their devices directly (17%). N.B. These tactics are not mutually exclusive. In addition to this, 
69% monitor their children’s internet usage - with a sharp age gradient dropping from 87% of those with 3-5-year olds 
down to 40% of those with 16-17-year olds. 


Turning to account usage, the proportion of children having their own accounts goes up with age, as might be expected 
(Figure 17). Of those whose children have their own accounts, a third (82%) of parents and carers do not have the 
password for any of them. 
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FIGURE 17 - CHILD’S ONLINE ACCOUNTS 

Q52 - For the things your child does online (e.g. social media, music and video streaming), do they have their own accounts? 

@ We have shared & They don't have their own ® They have their own @ They have their own 
accounts accounts so use ours accounts, but only for accounts for all the 

some things sites they use 

AGE OF CHILD 

TOTAL SAMPLE 

3-5 7% iS% 65% 13% 

144 

6-9 11% 30% 40% 18% 

465 

10-12 18% 40% 29% 13% 

507 

13-15 34% 48% 8% 10% 

522 

16-17 54% 35% 5% 7% 

364 


There are many types of service out there but to give a sense of usage, the following graph collects them together into 
four overall types: music streaming; video streaming, games and social media (Figure 18). Social media usage grows rapidly 
with age, from 15% of 3-5-year olds up to 93% of 16-17-year olds. This contrasts to video streaming which is important 
throughout childhood, even if the platforms used within this category vary, e.g. rise of Netflix with age and change from 
YouTube Kids to YouTube. 


AGE OF CHILD 
TOTAL SAMPLE 


ANNEX 
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FIGURE 18 - CHILD’S PLATFORM USAGE 


Q54 - Which of the following platforms, services, sites and apps does your child use? 


2) 


SOCIAL MEDIA 


3-5 
144 


T) 


MUSIC STREAMING 


6-9 
465 


10-12 
507 


VIDEO STREAMING 


13-15 
522 


VIDEO STREAMING 


93% 
91% 


16-17 
364 


OPEN LINK 
SURVEY 
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Annex 2 


Adults’ open-link survey 


The adults’ open-link survey was available for anyone to complete via the ICO website for a month (November 7‘ — 
December 5"). It contained the same questions as the main panel-based survey used in the adults’ quantitative research, 
but for reasons we go on to detail below, we have not analysed and presented it alongside the main sample of 2,002. In this 
appendix, we go on to detail the make-up of the sample and highlight some similarities and differences with the main adults’ 
quantitative findings. 


SAMPLE 


108 people completed the adults’ open-link survey; however, the sample is not representative of UK parents and carers (in 
contrast to the main adults’ survey) and so the results should be treated with caution. For example: 


m 32% of the open-link respondents were answering about a child that was between the ages of 3 and 7. This was 
the case for just 14% in the main survey which gave a sample that was well-balanced across all ages of child 

m 66% of open-link respondents were female, compared to a 50:50 split in the main survey 

m 37% of the open-link sample gave their region as the North West - the representative UK figure was 12% from the 
main survey 


COMMENTARY COMPARED WITH THE MAIN ADULTS’ SURVEY 


The open-link survey responses, as a general rule, tended towards the more safety-conscious or pro-privacy end of the 


spectrum. This manifested in a few ways: 


m Firstly, as a more pro-privacy view but one that mirrors what the majority of what the public think. For example: 
82% of the main sample said that a setting which would allow a site to “share data with third parties so that 
they can target your child with advertising material” should be OFF by default (Q16). This was 100% among the 
open-link responses 

m Secondly, where the pro-privacy nature of the views gave a different outcome to those in the main survey. For 
example, the majority from the main survey (65%) were happy for a site to send their child “notifications to say 


friends were online”. This was almost exactly reversed in the open-link responses, with the majority (66%) saying 
that this setting should be OFF by default 


Given the self-selecting nature of the open-link survey, and the fact it was promoted by ICO communications channels, it 


is perhaps no surprise that those more conscious and concerned about these types of issues seem to be those that have 


responded and given more “safety-first” or pro-privacy answers. 


The second thing to note is the impact of the age of child they are answering about in their responses. For example: 


m 16% of the main sample said their child would fully understand how their data was going to be used from a privacy 
notice/T&C’s. This was just 2% among the open-link responses (Q12). This is likely due to the relatively higher 
number of parents with young children answering the open-link survey, in comparison to the main adults’ survey 


m Likewise, when asked about a site using their child’s browsing history, ‘likes’ and friendship profile to target them 
with selected advertising material, just 3% of the open-link sample said they were very or fairly comfortable with 


this - compared to 28% of the main sample 


Finally, open-link respondents were keener to suggest that the ICO should take primary responsibility for their child’s 


information being used appropriately - 19% vs. 9% of the main sample. 
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